<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="anomalous" value="2.539300,1.875580,010,1 1 1 0 0 0 1 1 1 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="212.149.178.231" src_port="6000" dst_port="8080"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.590250,1.579810,999,1 1 1 1 0 0 0 0 0 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="206.206.120.252" dst_ip="192.168.96.4" src_port="53"/>
        </slice>
        <from usec="0" sec="1170392401"/>
        <to usec="0" sec="1170393286"/>
    </anomaly>
    <anomaly type="anomalous" value="2.539300,1.875580,010,1 1 1 0 0 0 1 1 1 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="206.187.15.208" src_port="40184" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.415050,1.890700,010,1 1 1 1 1 1 0 0 0 1 1 0,ntscSYNt">
        <slice>
            <filter src_ip="201.27.85.16" dst_port="20000"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.598710,1.591150,503,1 1 1 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="128.129.158.94" dst_ip="218.100.118.64" src_port="2859" dst_port="80"/>
        </slice>
        <from usec="0" sec="1170393160"/>
        <to usec="0" sec="1170393165"/>
    </anomaly>
    <anomaly type="anomalous" value="1.716830,1.607440,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="212.218.171.179" dst_port="445"/>
            <filter src_ip="212.218.171.179" dst_port="139"/>
        </slice>
        <from usec="0" sec="1170392758"/>
        <to usec="0" sec="1170392807"/>
    </anomaly>
    <anomaly type="anomalous" value="1.598710,1.591150,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="192.155.37.177" src_port="47370" dst_port="1026"/>
        </slice>
        <from usec="0" sec="1170392878"/>
        <to usec="0" sec="1170392880"/>
    </anomaly>
    <anomaly type="anomalous" value="1.598710,1.591150,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="209.32.131.79" src_port="37491" dst_port="1027"/>
            <filter src_ip="209.32.131.79" src_port="37491" dst_port="1026"/>
        </slice>
        <from usec="0" sec="1170392927"/>
        <to usec="0" sec="1170392931"/>
    </anomaly>
    <anomaly type="anomalous" value="1.598710,1.591150,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="170.215.154.103" dst_port="1026"/>
        </slice>
        <from usec="0" sec="1170393044"/>
        <to usec="0" sec="1170393047"/>
    </anomaly>
    <anomaly type="anomalous" value="1.598710,1.591150,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="154.180.23.70" dst_port="1026"/>
        </slice>
        <from usec="0" sec="1170393044"/>
        <to usec="0" sec="1170393047"/>
    </anomaly>
    <anomaly type="anomalous" value="1.598710,1.591150,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="194.155.226.228" dst_port="1026"/>
        </slice>
        <from usec="0" sec="1170392568"/>
        <to usec="0" sec="1170392571"/>
    </anomaly>
    <anomaly type="anomalous" value="1.716830,1.607440,001,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNtSAbado">
        <slice>
            <filter src_ip="218.148.232.128" dst_port="9898"/>
            <filter src_ip="218.148.232.128" dst_port="5554"/>
            <filter src_ip="218.148.232.128" dst_port="1023"/>
        </slice>
        <from usec="0" sec="1170392761"/>
        <to usec="0" sec="1170392807"/>
    </anomaly>
    <anomaly type="anomalous" value="1.598710,1.591150,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="212.243.22.221" dst_port="1026"/>
        </slice>
        <from usec="0" sec="1170393101"/>
        <to usec="0" sec="1170393103"/>
    </anomaly>
    <anomaly type="anomalous" value="1.598710,1.591150,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="218.52.199.177" dst_port="1026"/>
        </slice>
        <from usec="0" sec="1170393044"/>
        <to usec="0" sec="1170393047"/>
    </anomaly>
    <anomaly type="anomalous" value="1.627300,1.577710,999,0 0 0 1 1 1 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="149.124.131.175" src_port="6881"/>
        </slice>
        <from usec="0" sec="1170392401"/>
        <to usec="0" sec="1170393229"/>
    </anomaly>
    <anomaly type="anomalous" value="2.128100,1.640360,503,1 0 0 1 1 1 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="207.93.138.127" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.590250,1.579810,503,1 1 1 1 0 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="144.176.176.40" dst_port="80"/>
        </slice>
        <from usec="0" sec="1170392401"/>
        <to usec="0" sec="1170393049"/>
    </anomaly>
    <anomaly type="anomalous" value="2.092040,1.647680,503,0 0 0 1 1 1 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="149.160.91.208" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.092040,1.647680,503,0 0 0 1 1 1 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="214.106.14.208" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.321520,1.734950,503,1 1 1 1 1 0 1 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="144.176.170.224" dst_port="80"/>
            <filter dst_ip="150.111.124.239" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.092040,1.647680,503,0 0 0 1 1 1 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="144.176.170.224" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.526430,1.458470,999,0 0 0 1 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="206.57.208.163" dst_port="11994"/>
        </slice>
        <from usec="0" sec="1170392401"/>
        <to usec="0" sec="1170392987"/>
    </anomaly>
    <anomaly type="anomalous" value="1.584010,1.462540,999,1 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="193.238.10.80" dst_port="53"/>
        </slice>
        <from usec="0" sec="1170392401"/>
        <to usec="0" sec="1170392987"/>
    </anomaly>
    <anomaly type="anomalous" value="2.983760,2.145750,999,1 1 1 1 1 1 1 1 1 1 1 1,mptp">
        <slice>
            <filter dst_ip="206.206.125.226" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.535230,1.470760,020,0 0 0 0 0 0 1 1 1 0 0 0,DDoSIC">
        <slice>
            <filter dst_ip="193.38.230.208"/>
        </slice>
        <from usec="0" sec="1170392401"/>
        <to usec="0" sec="1170392987"/>
    </anomaly>
    <anomaly type="anomalous" value="1.752250,1.537410,999,0 0 0 1 1 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter src_ip="130.246.137.110" dst_ip="149.124.131.175"/>
            <filter dst_ip="149.124.131.175" dst_port="6881"/>
        </slice>
        <from usec="0" sec="1170392401"/>
        <to usec="0" sec="1170393229"/>
    </anomaly>
    <anomaly type="anomalous" value="2.983760,2.145750,503,1 1 1 1 1 1 1 1 1 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="207.93.138.127" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.183640,1.663420,503,0 0 0 1 1 1 1 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="149.160.91.214" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.535230,1.470760,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmpla">
        <slice>
            <filter src_ip="193.91.248.209" dst_ip="207.93.136.59" dst_port="3128"/>
            <filter src_ip="193.91.248.209" dst_ip="207.93.136.53" dst_port="3128"/>
        </slice>
        <from usec="0" sec="1170392401"/>
        <to usec="0" sec="1170393257"/>
    </anomaly>
    <anomaly type="anomalous" value="2.051990,1.526020,501,1 0 0 1 0 0 1 1 1 1 1 1,heavy_hitter">
        <slice>
            <filter src_ip="212.44.95.41" dst_ip="207.93.130.26" dst_port="21"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.535230,1.470760,999,0 0 0 0 0 0 1 1 1 0 0 0,alphfl">
        <slice>
            <filter src_ip="165.25.120.221" dst_ip="145.80.18.50" dst_port="2703"/>
        </slice>
        <from usec="0" sec="1170392401"/>
        <to usec="0" sec="1170392987"/>
    </anomaly>
    <anomaly type="anomalous" value="1.535230,1.470760,999,0 0 0 0 0 0 1 1 1 0 0 0,alphfl">
        <slice>
            <filter src_ip="193.172.88.69" dst_ip="128.217.173.153" dst_port="161"/>
        </slice>
        <from usec="0" sec="1170392401"/>
        <to usec="0" sec="1170392447"/>
    </anomaly>
    <anomaly type="anomalous" value="2.011050,1.515280,503,1 0 0 1 1 0 1 1 1 1 1 0,mptmp">
        <slice>
            <filter src_ip="206.57.211.81" dst_ip="215.108.37.3"/>
            <filter src_ip="206.57.211.81" dst_port="80"/>
            <filter src_ip="206.57.211.80" dst_port="80"/>
            <filter dst_ip="215.108.37.3" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.535230,1.470760,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter src_ip="152.139.172.189" dst_ip="161.40.104.82" dst_port="3128"/>
            <filter dst_ip="161.40.104.82" src_port="11271" dst_port="30255"/>
        </slice>
        <from usec="0" sec="1170392401"/>
        <to usec="0" sec="1170392987"/>
    </anomaly>
    <anomaly type="anomalous" value="1.535230,1.470760,999,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="161.40.104.93" dst_port="3124"/>
        </slice>
        <from usec="0" sec="1170392401"/>
        <to usec="0" sec="1170392987"/>
    </anomaly>
    <anomaly type="anomalous" value="1.535230,1.470760,999,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="161.40.104.92"/>
        </slice>
        <from usec="0" sec="1170392401"/>
        <to usec="0" sec="1170392447"/>
    </anomaly>
    <anomaly type="anomalous" value="1.535230,1.470760,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="161.40.186.9" dst_port="7774"/>
        </slice>
        <from usec="0" sec="1170392401"/>
        <to usec="0" sec="1170392987"/>
    </anomaly>
    <anomaly type="anomalous" value="1.671400,1.436190,503,1 0 0 1 0 0 1 1 1 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="193.38.234.116" dst_port="80"/>
            <filter dst_ip="193.38.234.116" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.791610,1.550680,020,1 1 0 0 0 0 1 1 1 0 0 0,icmp_error">
        <slice>
            <filter src_ip="209.49.126.149"/>
            <filter dst_ip="206.57.208.216"/>
        </slice>
        <from usec="0" sec="1170392401"/>
        <to usec="0" sec="1170392987"/>
    </anomaly>
    <anomaly type="anomalous" value="1.535230,1.470760,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="206.48.71.43" dst_port="12417"/>
        </slice>
        <from usec="0" sec="1170392401"/>
        <to usec="0" sec="1170392987"/>
    </anomaly>
    <anomaly type="anomalous" value="1.535230,1.470760,020,0 0 0 0 0 0 1 1 1 0 0 0,DDoSIC">
        <slice>
            <filter dst_ip="207.93.134.172"/>
        </slice>
        <from usec="0" sec="1170392401"/>
        <to usec="0" sec="1170392987"/>
    </anomaly>
    <anomaly type="anomalous" value="1.535230,1.470760,999,0 0 0 0 0 0 1 1 1 0 0 0,mptpla">
        <slice>
            <filter src_ip="206.202.213.91" dst_ip="207.93.133.246" dst_port="53"/>
            <filter src_ip="206.202.211.253" dst_ip="207.93.133.246" dst_port="53"/>
        </slice>
        <from usec="0" sec="1170392401"/>
        <to usec="0" sec="1170392447"/>
    </anomaly>
    <anomaly type="anomalous" value="1.535230,1.470760,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="207.93.133.234" dst_port="53"/>
        </slice>
        <from usec="0" sec="1170392401"/>
        <to usec="0" sec="1170392987"/>
    </anomaly>
    <anomaly type="anomalous" value="1.535230,1.470760,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="206.57.209.83" dst_port="53"/>
            <filter dst_ip="206.57.209.83" src_port="53" dst_port="49518"/>
        </slice>
        <from usec="0" sec="1170392401"/>
        <to usec="0" sec="1170392987"/>
    </anomaly>
    <anomaly type="anomalous" value="1.535230,1.470760,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="149.178.17.17" dst_port="53"/>
        </slice>
        <from usec="0" sec="1170392401"/>
        <to usec="0" sec="1170392987"/>
    </anomaly>
    <anomaly type="anomalous" value="1.535230,1.470760,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="149.178.214.133" dst_port="53"/>
        </slice>
        <from usec="0" sec="1170392401"/>
        <to usec="0" sec="1170392447"/>
    </anomaly>
    <anomaly type="anomalous" value="1.371370,1.239240,503,1 0 0 1 1 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="193.229.101.99" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.001180,1.524850,503,1 1 0 1 0 0 1 1 1 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="144.176.13.104" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.178320,1.600520,999,1 1 0 1 1 0 1 1 1 1 1 0,ptmp">
        <slice>
            <filter src_ip="161.40.104.92" src_port="3128"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.376540,1.261920,503,0 0 0 1 0 0 0 0 0 1 1 1,salphfl">
        <slice>
            <filter src_ip="150.111.124.226" dst_ip="144.176.65.160" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.440130,1.266630,503,1 0 0 0 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="149.160.91.215" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.903170,1.556160,503,1 0 0 1 1 1 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="128.129.229.97" dst_ip="169.174.231.119" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.092040,1.647680,503,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="193.229.101.125" src_port="80"/>
            <filter dst_ip="144.176.8.51" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.183640,1.663420,503,0 0 0 1 1 1 1 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="206.57.232.180" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.586970,1.857720,503,1 0 0 1 1 1 1 1 1 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="128.129.202.209" dst_ip="192.180.7.28" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.092040,1.647680,503,0 0 0 1 1 1 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="149.178.17.80" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.286830,1.719400,503,1 1 0 1 1 1 0 0 0 1 1 1,salphfl">
        <slice>
            <filter src_ip="137.193.45.240" dst_ip="219.1.218.220" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.376540,1.261920,503,0 0 0 1 0 0 0 0 0 1 1 1,point_to_point">
        <slice>
            <filter src_ip="144.176.61.79" dst_ip="193.229.101.29" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.430740,1.252340,999,1 0 0 1 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="149.178.17.23" src_port="25"/>
            <filter src_ip="149.178.17.23" dst_port="25"/>
            <filter src_ip="149.178.17.158" src_port="25"/>
            <filter src_ip="149.178.17.158" dst_port="25"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.386300,1.276100,999,0 0 0 0 0 0 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="207.93.138.107"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.386300,1.276100,503,0 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="216.82.229.146" dst_ip="149.160.91.213" src_port="80" dst_port="65211"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.386300,1.276100,503,0 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="215.68.135.195" dst_ip="149.76.100.85" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.356860,1.250920,503,1 1 0 1 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter dst_ip="200.44.3.225" dst_port="80"/>
            <filter dst_ip="150.3.170.114" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.386300,1.276100,503,0 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="197.4.235.60" dst_ip="144.176.176.40" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.386300,1.276100,999,0 0 0 0 0 0 0 0 0 1 1 1,mptpla">
        <slice>
            <filter dst_ip="149.178.129.2" dst_port="25"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.376540,1.261920,999,0 0 0 1 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="149.178.17.23" dst_port="25"/>
            <filter dst_ip="149.178.17.158" dst_port="25"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.503220,1.285650,503,1 1 0 0 0 0 1 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="175.17.4.173"/>
            <filter dst_ip="161.40.25.14" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.092040,1.647680,503,0 0 0 1 1 1 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="144.176.13.104" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.440130,1.266630,999,1 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="137.193.204.90" dst_ip="218.100.80.182" src_port="113"/>
            <filter src_ip="137.193.204.90" dst_ip="218.100.80.182" dst_port="25"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.430740,1.252340,503,1 0 0 1 0 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="144.176.173.95" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.386300,1.276100,503,0 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="161.40.150.205" src_port="80"/>
            <filter dst_ip="149.1.89.160" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.356860,1.250920,503,1 1 0 1 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="144.176.65.203" dst_port="80"/>
            <filter dst_ip="206.241.135.1" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.022860,1.282280,503,1 1 0 0 0 0 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="149.165.213.39" dst_ip="193.38.220.211" src_port="3512" dst_port="80"/>
            <filter src_ip="149.165.213.39" dst_ip="193.38.220.211" src_port="3511" dst_port="80"/>
        </slice>
        <from usec="0" sec="1170392782"/>
        <to usec="0" sec="1170392785"/>
    </anomaly>
    <anomaly type="suspicious" value="1.187820,1.288550,503,1 1 0 1 0 0 1 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="206.57.232.180" dst_port="80"/>
        </slice>
        <from usec="0" sec="1170392401"/>
        <to usec="0" sec="1170393229"/>
    </anomaly>
    <anomaly type="suspicious" value="1.022860,1.282280,503,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="149.178.17.22" dst_ip="150.111.106.78" src_port="80"/>
        </slice>
        <from usec="0" sec="1170392950"/>
        <to usec="0" sec="1170393284"/>
    </anomaly>
    <anomaly type="suspicious" value="1.199110,1.302430,010,1 1 0 0 0 0 1 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="193.17.149.17" dst_port="445"/>
            <filter src_ip="193.17.149.17" dst_port="139"/>
        </slice>
        <from usec="0" sec="1170392803"/>
        <to usec="0" sec="1170392852"/>
    </anomaly>
    <anomaly type="suspicious" value="1.022860,1.282280,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="148.56.177.2" dst_ip="161.40.89.45" src_port="80" dst_port="1700"/>
        </slice>
        <from usec="0" sec="1170392767"/>
        <to usec="0" sec="1170392803"/>
    </anomaly>
    <anomaly type="suspicious" value="0.945564,1.291640,901,0 1 0 0 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="206.206.126.40" dst_ip="206.206.126.40" proto="udp"/>
        </slice>
        <from usec="0" sec="1170392401"/>
        <to usec="0" sec="1170393294"/>
    </anomaly>
    <anomaly type="suspicious" value="1.022860,1.282280,999,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="202.212.21.37" dst_ip="207.93.136.59" dst_port="3128"/>
        </slice>
        <from usec="0" sec="1170392782"/>
        <to usec="0" sec="1170392787"/>
    </anomaly>
    <anomaly type="suspicious" value="1.199110,1.302430,999,1 1 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="209.33.148.144" src_port="33377" dst_port="1026"/>
            <filter src_ip="209.33.148.144" src_port="33377" dst_port="1027"/>
        </slice>
        <from usec="0" sec="1170392761"/>
        <to usec="0" sec="1170392807"/>
    </anomaly>
    <anomaly type="suspicious" value="1.022860,1.282280,999,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="154.131.8.96" dst_port="1026"/>
        </slice>
        <from usec="0" sec="1170393045"/>
        <to usec="0" sec="1170393046"/>
    </anomaly>
    <anomaly type="suspicious" value="1.022860,1.282280,999,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="154.133.212.173" dst_port="1026"/>
        </slice>
        <from usec="0" sec="1170393045"/>
        <to usec="0" sec="1170393047"/>
    </anomaly>
    <anomaly type="suspicious" value="1.022860,1.282280,999,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="192.183.167.14" dst_port="1026"/>
        </slice>
        <from usec="0" sec="1170392570"/>
        <to usec="0" sec="1170392573"/>
    </anomaly>
    <anomaly type="suspicious" value="1.022860,1.282280,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="140.169.67.11" dst_port="445"/>
            <filter src_ip="140.169.67.11" dst_port="139"/>
        </slice>
        <from usec="0" sec="1170392951"/>
        <to usec="0" sec="1170393296"/>
    </anomaly>
    <anomaly type="suspicious" value="0.952221,1.266190,999,0 0 0 1 1 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="149.165.113.145" dst_ip="213.74.0.96" src_port="11603" dst_port="39799"/>
        </slice>
        <from usec="0" sec="1170392402"/>
        <to usec="0" sec="1170392599"/>
    </anomaly>
    <anomaly type="suspicious" value="0.952221,1.266190,503,0 0 0 1 1 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="161.40.66.215" dst_ip="148.56.177.156" src_port="1711" dst_port="80"/>
            <filter src_ip="161.40.66.215" dst_ip="148.56.177.156" src_port="1521" dst_port="80"/>
        </slice>
        <from usec="0" sec="1170392401"/>
        <to usec="0" sec="1170392539"/>
    </anomaly>
    <anomaly type="suspicious" value="0.952221,1.266190,503,0 0 0 1 1 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="137.193.92.35" dst_ip="207.53.139.121" dst_port="80"/>
            <filter src_ip="149.165.198.87" dst_ip="207.53.139.121" dst_port="80"/>
        </slice>
        <from usec="0" sec="1170392413"/>
        <to usec="0" sec="1170392778"/>
    </anomaly>
    <anomaly type="suspicious" value="0.952221,1.266190,503,0 0 0 1 1 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="206.57.211.56" dst_ip="129.246.18.234" dst_port="80"/>
        </slice>
        <from usec="0" sec="1170392401"/>
        <to usec="0" sec="1170392748"/>
    </anomaly>
    <anomaly type="suspicious" value="0.952221,1.266190,999,0 0 0 1 1 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="215.108.38.163" dst_port="5050"/>
        </slice>
        <from usec="0" sec="1170392403"/>
        <to usec="0" sec="1170392868"/>
    </anomaly>
    <anomaly type="suspicious" value="0.952221,1.266190,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="154.9.196.160" dst_ip="144.176.149.160" src_port="80"/>
        </slice>
        <from usec="0" sec="1170392585"/>
        <to usec="0" sec="1170393219"/>
    </anomaly>
    <anomaly type="suspicious" value="0.952221,1.266190,999,0 0 0 1 1 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="215.4.42.76" dst_ip="162.14.34.38" src_port="20200" dst_port="1027"/>
        </slice>
        <from usec="0" sec="1170392401"/>
        <to usec="0" sec="1170392959"/>
    </anomaly>
    <anomaly type="suspicious" value="0.952221,1.266190,503,0 0 0 1 1 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="144.176.187.90" src_port="80"/>
        </slice>
        <from usec="0" sec="1170392410"/>
        <to usec="0" sec="1170393040"/>
    </anomaly>
    <anomaly type="suspicious" value="0.952221,1.266190,503,0 0 0 1 1 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="149.178.146.137" dst_port="80"/>
        </slice>
        <from usec="0" sec="1170392428"/>
        <to usec="0" sec="1170393049"/>
    </anomaly>
    <anomaly type="suspicious" value="0.952221,1.266190,503,0 0 0 1 1 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="207.93.134.68" dst_port="80"/>
        </slice>
        <from usec="0" sec="1170392401"/>
        <to usec="0" sec="1170393139"/>
    </anomaly>
    <anomaly type="suspicious" value="0.952221,1.266190,503,0 0 0 1 1 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="150.111.101.84" dst_ip="149.178.57.149" dst_port="80"/>
        </slice>
        <from usec="0" sec="1170392401"/>
        <to usec="0" sec="1170393139"/>
    </anomaly>
    <anomaly type="suspicious" value="0.952221,1.266190,999,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="144.176.194.128" dst_ip="200.44.169.106" src_port="50004" dst_port="1863"/>
            <filter src_ip="144.176.194.128" dst_ip="200.44.169.106" src_port="49996" dst_port="1863"/>
            <filter src_ip="144.176.194.128" dst_ip="200.44.169.106" src_port="49987" dst_port="1863"/>
            <filter src_ip="144.176.194.128" dst_ip="200.44.169.106" src_port="49979" dst_port="1863"/>
            <filter src_ip="144.176.194.128" dst_ip="200.44.169.106" src_port="49458" dst_port="1863"/>
        </slice>
        <from usec="0" sec="1170392418"/>
        <to usec="0" sec="1170393115"/>
    </anomaly>
    <anomaly type="suspicious" value="0.952221,1.266190,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="149.165.139.177" dst_ip="218.60.128.202" dst_port="80"/>
        </slice>
        <from usec="0" sec="1170392421"/>
        <to usec="0" sec="1170393123"/>
    </anomaly>
    <anomaly type="suspicious" value="1.204370,1.277210,999,1 0 0 1 1 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="206.48.71.43" src_port="12417"/>
        </slice>
        <from usec="0" sec="1170392401"/>
        <to usec="0" sec="1170393257"/>
    </anomaly>
    <anomaly type="suspicious" value="1.029020,1.256640,999,1 0 0 1 1 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="193.238.10.87" src_port="53"/>
        </slice>
        <from usec="0" sec="1170392401"/>
        <to usec="0" sec="1170393286"/>
    </anomaly>
    <anomaly type="suspicious" value="0.858535,1.196140,002,1 0 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="193.152.96.211" src_port="1029" dst_port="137"/>
        </slice>
        <from usec="0" sec="1170393211"/>
        <to usec="0" sec="1170393257"/>
    </anomaly>
    <anomaly type="suspicious" value="1.199240,1.337640,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="144.176.16.19" dst_port="53"/>
        </slice>
        <from usec="0" sec="1170392401"/>
        <to usec="0" sec="1170392447"/>
    </anomaly>
    <anomaly type="suspicious" value="1.261080,1.328600,999,1 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="207.93.135.121" dst_port="49972"/>
        </slice>
        <from usec="0" sec="1170392536"/>
        <to usec="0" sec="1170392810"/>
    </anomaly>
    <anomaly type="suspicious" value="0.793692,1.141170,503,1 0 0 1 0 0 0 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="144.176.137.223" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.080390,1.155520,503,1 0 0 0 0 0 0 0 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="144.176.92.235" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.010730,1.163780,999,1 0 0 1 0 0 1 0 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="144.176.161.154" src_port="22220"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.810498,1.156830,503,1 0 0 0 0 0 0 0 0 1 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="144.176.48.28" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.994047,1.150360,501,0 0 0 1 0 0 0 0 0 1 1 0,heavy_hitter">
        <slice>
            <filter src_ip="207.93.130.26" dst_ip="212.44.95.41" src_port="21"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.994047,1.150360,503,0 0 0 1 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="149.160.91.212" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.186050,1.188030,503,0 0 0 0 0 0 1 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="149.160.91.209" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.994047,1.150360,503,0 0 0 1 0 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter dst_ip="207.93.131.71" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.994047,1.150360,503,0 0 0 1 0 0 0 0 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="149.178.17.81" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.007520,1.165890,503,0 0 0 0 0 0 0 0 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="206.48.93.240" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.007520,1.165890,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="216.82.229.204" dst_ip="149.178.198.110" src_port="80" dst_port="4107"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.007520,1.165890,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="216.82.232.166" dst_ip="161.40.228.170" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.007520,1.165890,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="216.97.122.23" dst_ip="144.176.149.201" src_port="80" dst_port="2457"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.007520,1.165890,503,0 0 0 0 0 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter src_ip="161.40.37.172" dst_ip="206.43.66.194" src_port="80" dst_port="41582"/>
            <filter src_ip="149.165.184.121" dst_ip="206.43.66.194" src_port="80" dst_port="41415"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.007520,1.165890,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="149.165.220.158" dst_ip="206.241.133.20" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
