<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="anomalous" value="1.558180,1.433590,503,1 1 1 1 1 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="25.75.229.60" dst_ip="153.21.60.251" dst_port="80"/>
        </slice>
        <from usec="0" sec="1172898000"/>
        <to usec="0" sec="1172898828"/>
    </anomaly>
    <anomaly type="anomalous" value="1.192570,1.165290,999,1 1 0 1 1 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="215.17.163.181"/>
        </slice>
        <from usec="0" sec="1172898000"/>
        <to usec="0" sec="1172898774"/>
    </anomaly>
    <anomaly type="anomalous" value="1.622490,1.505360,010,1 1 0 0 0 0 1 1 1 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="215.18.151.110" dst_port="139"/>
        </slice>
        <from usec="0" sec="1172898000"/>
        <to usec="0" sec="1172898046"/>
    </anomaly>
    <anomaly type="anomalous" value="2.037310,1.575950,503,1 1 1 1 1 1 1 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="214.125.67.55" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.111710,1.086130,503,1 0 0 1 1 0 0 0 0 1 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="153.21.60.251" dst_ip="25.75.229.60" src_port="80"/>
            <filter src_ip="153.21.60.251" dst_ip="25.85.37.99" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.968220,1.437960,503,1 0 0 1 1 1 1 1 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="153.21.195.212" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.893460,1.381160,503,1 1 0 1 1 1 1 0 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="214.125.67.55" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.171040,1.117650,503,1 0 0 1 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="182.246.32.142" dst_ip="100.21.200.10" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.782200,1.448460,503,1 1 1 1 0 0 1 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="153.21.195.212" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.192570,1.165290,999,1 1 0 1 1 0 1 0 0 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="215.140.37.100" dst_ip="192.168.96.4" src_port="53"/>
        </slice>
        <from usec="0" sec="1172898000"/>
        <to usec="0" sec="1172898854"/>
    </anomaly>
    <anomaly type="anomalous" value="1.171040,1.117650,503,1 0 0 1 0 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter src_ip="185.196.131.3" dst_ip="96.155.110.39" dst_port="80"/>
            <filter src_ip="170.123.236.136" dst_ip="96.155.110.39" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.067690,1.597070,503,0 0 0 1 1 1 0 0 0 1 1 1,mptplaHTTP">
        <slice>
            <filter src_ip="89.130.122.254" dst_ip="170.123.93.133" src_port="80"/>
            <filter src_ip="89.130.116.132" dst_ip="170.123.93.133" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.612010,1.945490,503,1 1 1 1 1 0 1 1 1 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="215.28.81.57" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.092410,1.575370,503,1 0 0 1 1 1 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="214.125.74.251" src_port="21"/>
            <filter src_ip="214.125.74.251" dst_ip="31.128.254.59" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.355650,1.320410,999,0 0 0 1 1 1 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="214.125.67.32" dst_ip="97.0.75.222"/>
            <filter src_ip="214.125.67.32" src_port="8080"/>
            <filter dst_ip="97.0.75.222" src_port="8080"/>
        </slice>
        <from usec="0" sec="1172898000"/>
        <to usec="0" sec="1172898828"/>
    </anomaly>
    <anomaly type="anomalous" value="1.767190,1.414900,999,0 0 0 1 1 1 1 1 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="172.89.155.21" src_port="6881"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.788980,1.499490,503,1 1 1 1 0 0 1 1 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="172.169.80.165" dst_port="80"/>
            <filter src_ip="215.28.81.73" dst_port="80"/>
            <filter dst_ip="26.29.20.64" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.499630,1.463280,002,1 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="98.218.170.119" src_port="31202" dst_port="137"/>
        </slice>
        <from usec="0" sec="1172898000"/>
        <to usec="0" sec="1172898046"/>
    </anomaly>
    <anomaly type="anomalous" value="2.558910,1.878160,999,1 1 1 1 1 1 1 1 1 1 1 0,mptmp">
        <slice>
            <filter dst_ip="215.140.32.140" dst_port="53"/>
            <filter dst_ip="215.140.34.81" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.201550,1.092260,999,1 0 0 1 1 0 1 0 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="172.89.155.21" dst_port="6881"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.428980,1.841970,010,1 1 1 1 1 1 1 1 1 1 0 0,ntscSYNt">
        <slice>
            <filter src_ip="214.97.232.171" dst_port="135"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.638630,1.486960,020,0 0 0 1 1 0 1 1 1 0 0 0,ntscICec">
        <slice>
            <filter src_ip="206.169.115.38"/>
        </slice>
        <from usec="0" sec="1172898000"/>
        <to usec="0" sec="1172898828"/>
    </anomaly>
    <anomaly type="anomalous" value="1.629100,1.449570,020,1 0 0 0 0 0 1 1 1 1 0 0,ptmp">
        <slice>
            <filter src_ip="24.5.144.61"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.948060,1.632810,999,0 0 0 1 1 1 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="172.169.196.43" dst_port="53"/>
        </slice>
        <from usec="0" sec="1172898000"/>
        <to usec="0" sec="1172898825"/>
    </anomaly>
    <anomaly type="anomalous" value="2.067690,1.597070,503,0 0 0 1 1 1 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="172.169.25.187" src_port="80"/>
            <filter dst_ip="172.169.25.187" dst_port="6346"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.080000,1.691540,503,1 1 1 0 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="96.155.109.35" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.092410,1.575370,503,1 0 0 1 1 1 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="172.169.161.86" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.201550,1.092260,999,1 0 0 1 1 0 1 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="172.169.41.62" src_port="25"/>
            <filter src_ip="172.169.41.62" dst_port="25"/>
            <filter src_ip="170.123.212.197" dst_port="25"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.171040,1.117650,503,1 0 0 1 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="172.169.25.187" src_port="6346"/>
            <filter src_ip="172.169.25.187" dst_port="80"/>
            <filter src_ip="172.169.25.187" dst_port="6348"/>
            <filter src_port="6346" dst_port="6348"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.730260,1.330170,503,1 0 0 1 1 1 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="172.169.41.141" src_port="80"/>
            <filter src_ip="214.125.73.81" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.628770,1.424940,503,0 0 0 1 0 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="214.125.79.101" src_port="21"/>
            <filter src_ip="214.125.79.101" dst_ip="199.73.24.163" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.229260,1.618670,503,1 1 0 1 1 1 1 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="214.125.74.251" dst_port="80"/>
            <filter dst_ip="214.125.74.251" dst_port="21"/>
            <filter dst_ip="214.125.79.101" dst_port="80"/>
            <filter dst_ip="214.125.79.101" dst_port="21"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.092410,1.575370,503,1 0 0 1 1 1 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="215.28.81.57" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.750420,1.470390,999,1 1 0 1 0 0 1 1 1 1 0 0,mptmp">
        <slice>
            <filter src_ip="96.213.116.168" dst_port="3124"/>
            <filter dst_ip="214.125.64.208" dst_port="3124"/>
            <filter dst_ip="214.125.64.208" dst_port="3128"/>
            <filter dst_ip="214.125.64.209" dst_port="3128"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.141490,1.579600,503,1 0 0 1 1 1 1 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="170.123.90.182" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.055410,1.536830,999,1 1 0 1 1 0 1 1 1 1 1 0,mptmp">
        <slice>
            <filter src_ip="153.21.195.132"/>
            <filter src_ip="214.125.64.208" src_port="3124"/>
            <filter src_ip="153.21.195.136" src_port="3128"/>
            <filter dst_ip="96.213.116.168" src_port="3127"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.779200,1.447620,999,0 0 0 1 1 0 0 0 0 1 1 1,ipv4gretun">
        <slice>
            <filter src_ip="214.78.123.93"/>
            <filter src_ip="215.87.63.222"/>
            <filter dst_ip="215.28.82.32"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.620640,1.447270,503,0 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="204.217.21.86" dst_ip="172.180.31.144" src_port="80" dst_port="57060"/>
            <filter src_ip="204.217.21.86" dst_ip="172.180.31.144" src_port="80" dst_port="56582"/>
            <filter src_ip="204.217.21.86" dst_ip="172.180.31.144" src_port="80" dst_port="56455"/>
            <filter src_ip="204.217.21.86" dst_ip="172.180.31.144" src_port="80" dst_port="56160"/>
            <filter src_ip="204.217.21.86" dst_ip="172.180.31.144" src_port="80" dst_port="56079"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.372580,1.146430,503,1 0 0 1 1 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="205.23.56.75" src_port="80"/>
            <filter dst_ip="214.125.67.64" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.620640,1.447270,503,0 0 0 0 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="215.17.14.255" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.444440,1.821360,503,1 1 1 1 1 1 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="215.28.110.173" src_port="80"/>
            <filter dst_ip="215.28.110.173" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.067690,1.597070,503,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="170.123.129.23" dst_port="4672"/>
            <filter dst_ip="170.123.50.19" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.906780,1.503330,503,1 0 0 1 0 0 1 1 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="170.123.129.23" src_port="4672"/>
            <filter src_ip="170.123.129.23" dst_port="80"/>
            <filter src_ip="215.17.14.255" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.821796,1.159110,503,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="170.123.176.126" dst_ip="24.85.43.72" src_port="4703" dst_port="80"/>
        </slice>
        <from usec="0" sec="1172898010"/>
        <to usec="0" sec="1172898013"/>
    </anomaly>
    <anomaly type="suspicious" value="0.821796,1.159110,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="153.21.10.134" dst_ip="204.252.222.96" src_port="3063" dst_port="80"/>
        </slice>
        <from usec="0" sec="1172898017"/>
        <to usec="0" sec="1172898030"/>
    </anomaly>
    <anomaly type="suspicious" value="0.821796,1.159110,503,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="153.21.9.21" dst_ip="215.182.236.55" src_port="4781" dst_port="80"/>
            <filter src_ip="153.21.9.21" dst_ip="215.182.236.55" src_port="4780" dst_port="80"/>
            <filter src_ip="153.21.9.21" dst_ip="215.182.236.55" src_port="4779" dst_port="80"/>
        </slice>
        <from usec="0" sec="1172898010"/>
        <to usec="0" sec="1172898013"/>
    </anomaly>
    <anomaly type="suspicious" value="0.821796,1.159110,999,1 1 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="156.139.186.165" dst_ip="24.18.155.177" src_port="1064" dst_port="22"/>
            <filter src_ip="156.139.186.165" dst_ip="208.243.0.228" src_port="110" dst_port="49374"/>
            <filter src_ip="156.139.186.165" dst_ip="196.38.191.189"/>
        </slice>
        <from usec="0" sec="1172898176"/>
        <to usec="0" sec="1172898188"/>
    </anomaly>
    <anomaly type="suspicious" value="0.821796,1.159110,504,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="214.125.67.64" dst_ip="18.241.38.12" dst_port="443"/>
        </slice>
        <from usec="0" sec="1172898013"/>
        <to usec="0" sec="1172898791"/>
    </anomaly>
    <anomaly type="suspicious" value="0.821796,1.159110,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="153.21.8.170" dst_ip="24.85.38.78" src_port="3679" dst_port="80"/>
        </slice>
        <from usec="0" sec="1172898020"/>
        <to usec="0" sec="1172898076"/>
    </anomaly>
    <anomaly type="suspicious" value="0.837709,1.131100,503,1 1 0 1 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="96.134.9.56" dst_port="80"/>
        </slice>
        <from usec="0" sec="1172898000"/>
        <to usec="0" sec="1172898639"/>
    </anomaly>
    <anomaly type="suspicious" value="0.821796,1.159110,503,1 1 0 0 0 0 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="172.179.114.167" dst_ip="214.1.98.93" dst_port="80"/>
        </slice>
        <from usec="0" sec="1172898042"/>
        <to usec="0" sec="1172898098"/>
    </anomaly>
    <anomaly type="suspicious" value="0.821796,1.159110,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="170.123.47.169" dst_ip="24.85.38.76" src_port="2023" dst_port="80"/>
        </slice>
        <from usec="0" sec="1172898016"/>
        <to usec="0" sec="1172898070"/>
    </anomaly>
    <anomaly type="suspicious" value="0.821796,1.159110,503,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="170.123.217.34" dst_ip="215.160.48.79" src_port="2542" dst_port="80"/>
            <filter src_ip="170.123.217.34" dst_ip="215.160.48.79" src_port="2541" dst_port="80"/>
        </slice>
        <from usec="0" sec="1172898042"/>
        <to usec="0" sec="1172898045"/>
    </anomaly>
    <anomaly type="suspicious" value="0.821796,1.159110,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="35.192.220.223" dst_port="445"/>
            <filter src_ip="35.192.220.223" dst_port="139"/>
        </slice>
        <from usec="0" sec="1172898027"/>
        <to usec="0" sec="1172898250"/>
    </anomaly>
    <anomaly type="suspicious" value="0.821796,1.159110,504,1 1 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="170.123.18.16" dst_ip="210.49.74.42" dst_port="443"/>
            <filter src_ip="170.123.18.16" dst_ip="25.84.20.81" dst_port="443"/>
        </slice>
        <from usec="0" sec="1172898800"/>
        <to usec="0" sec="1172898810"/>
    </anomaly>
    <anomaly type="suspicious" value="1.374360,1.433230,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="215.166.218.185" dst_port="139"/>
        </slice>
        <from usec="0" sec="1172898298"/>
        <to usec="0" sec="1172898424"/>
    </anomaly>
    <anomaly type="suspicious" value="1.039440,1.141750,503,1 1 0 0 0 0 0 0 0 1 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="170.123.206.195" dst_ip="195.17.149.109" dst_port="80"/>
            <filter src_ip="170.123.206.195" dst_ip="195.17.149.105" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.821796,1.159110,002,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="215.222.138.170" src_port="1033" dst_port="137"/>
        </slice>
        <from usec="0" sec="1172898176"/>
        <to usec="0" sec="1172898190"/>
    </anomaly>
    <anomaly type="suspicious" value="0.939764,1.164850,002,1 1 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="6.10.174.121" src_port="20386" dst_port="137"/>
        </slice>
        <from usec="0" sec="1172898540"/>
        <to usec="0" sec="1172898586"/>
    </anomaly>
    <anomaly type="suspicious" value="0.821796,1.159110,002,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="199.164.98.2" src_port="1025" dst_port="137"/>
        </slice>
        <from usec="0" sec="1172898675"/>
        <to usec="0" sec="1172898689"/>
    </anomaly>
    <anomaly type="suspicious" value="0.939764,1.164850,999,1 1 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="199.0.134.141" src_port="47276" dst_port="1026"/>
            <filter src_ip="199.0.134.141" src_port="47276" dst_port="1027"/>
        </slice>
        <from usec="0" sec="1172898810"/>
        <to usec="0" sec="1172898856"/>
    </anomaly>
    <anomaly type="suspicious" value="0.821796,1.159110,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="0.124.104.66" dst_port="139"/>
        </slice>
        <from usec="0" sec="1172898757"/>
        <to usec="0" sec="1172898775"/>
    </anomaly>
    <anomaly type="suspicious" value="0.821796,1.159110,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="213.139.137.85" dst_port="135"/>
        </slice>
        <from usec="0" sec="1172898599"/>
        <to usec="0" sec="1172898615"/>
    </anomaly>
    <anomaly type="suspicious" value="0.821796,1.159110,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="74.128.239.156" dst_port="445"/>
        </slice>
        <from usec="0" sec="1172898727"/>
        <to usec="0" sec="1172898773"/>
    </anomaly>
    <anomaly type="suspicious" value="1.374360,1.433230,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="213.37.52.98" dst_port="1026"/>
        </slice>
        <from usec="0" sec="1172898778"/>
        <to usec="0" sec="1172898780"/>
    </anomaly>
    <anomaly type="suspicious" value="1.374360,1.433230,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="200.169.23.59" dst_port="1026"/>
        </slice>
        <from usec="0" sec="1172898515"/>
        <to usec="0" sec="1172898517"/>
    </anomaly>
    <anomaly type="suspicious" value="0.821796,1.159110,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="213.140.91.150" dst_port="135"/>
        </slice>
        <from usec="0" sec="1172898424"/>
        <to usec="0" sec="1172898440"/>
    </anomaly>
    <anomaly type="suspicious" value="1.374360,1.433230,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="208.15.176.190" dst_port="1026"/>
        </slice>
        <from usec="0" sec="1172898714"/>
        <to usec="0" sec="1172898718"/>
    </anomaly>
    <anomaly type="suspicious" value="1.374360,1.433230,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="0.172.8.204" dst_port="1026"/>
        </slice>
        <from usec="0" sec="1172898214"/>
        <to usec="0" sec="1172898217"/>
    </anomaly>
    <anomaly type="suspicious" value="0.821796,1.159110,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="198.68.212.81" dst_port="445"/>
            <filter src_ip="198.68.212.81" dst_port="139"/>
        </slice>
        <from usec="0" sec="1172898705"/>
        <to usec="0" sec="1172898809"/>
    </anomaly>
    <anomaly type="suspicious" value="1.374360,1.433230,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="213.137.197.247" dst_port="445"/>
        </slice>
        <from usec="0" sec="1172898769"/>
        <to usec="0" sec="1172898773"/>
    </anomaly>
    <anomaly type="suspicious" value="0.939764,1.164850,010,1 1 0 0 0 0 1 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="206.140.215.81" dst_port="445"/>
            <filter src_ip="206.140.215.81" dst_port="139"/>
        </slice>
        <from usec="0" sec="1172898080"/>
        <to usec="0" sec="1172898136"/>
    </anomaly>
    <anomaly type="suspicious" value="1.374360,1.433230,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="164.40.248.82" dst_port="1026"/>
        </slice>
        <from usec="0" sec="1172898214"/>
        <to usec="0" sec="1172898216"/>
    </anomaly>
    <anomaly type="suspicious" value="1.374360,1.433230,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="213.139.149.204" dst_port="2967"/>
        </slice>
        <from usec="0" sec="1172898268"/>
        <to usec="0" sec="1172898281"/>
    </anomaly>
    <anomaly type="suspicious" value="1.374360,1.433230,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="33.240.233.8" dst_port="1026"/>
        </slice>
        <from usec="0" sec="1172898594"/>
        <to usec="0" sec="1172898599"/>
    </anomaly>
    <anomaly type="suspicious" value="0.821796,1.159110,503,1 1 0 0 0 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="172.169.185.3" dst_port="80"/>
        </slice>
        <from usec="0" sec="1172898037"/>
        <to usec="0" sec="1172898067"/>
    </anomaly>
    <anomaly type="suspicious" value="0.837599,1.163010,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1172898000"/>
        <to usec="0" sec="1172898558"/>
    </anomaly>
    <anomaly type="suspicious" value="0.837599,1.163010,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1172898000"/>
        <to usec="0" sec="1172898558"/>
    </anomaly>
    <anomaly type="suspicious" value="0.853218,1.135100,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="153.21.37.69" dst_ip="25.85.37.92" src_port="80"/>
        </slice>
        <from usec="0" sec="1172898016"/>
        <to usec="0" sec="1172898818"/>
    </anomaly>
    <anomaly type="suspicious" value="0.853218,1.135100,999,0 0 0 1 1 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="214.125.75.53" dst_port="25"/>
        </slice>
        <from usec="0" sec="1172898000"/>
        <to usec="0" sec="1172898378"/>
    </anomaly>
    <anomaly type="suspicious" value="0.853218,1.135100,503,0 0 0 1 1 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="156.139.188.208" src_port="25"/>
            <filter src_ip="156.139.188.208" src_port="80"/>
        </slice>
        <from usec="0" sec="1172898000"/>
        <to usec="0" sec="1172898378"/>
    </anomaly>
    <anomaly type="suspicious" value="0.853218,1.135100,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="156.139.248.4" dst_ip="25.85.32.44" src_port="80"/>
        </slice>
        <from usec="0" sec="1172898020"/>
        <to usec="0" sec="1172898325"/>
    </anomaly>
    <anomaly type="suspicious" value="0.853218,1.135100,010,0 0 0 1 1 0 0 0 0 0 0 0,sptpDoSSYN">
        <slice>
            <filter src_ip="100.155.97.49" dst_ip="170.123.234.180" dst_port="42102"/>
            <filter src_ip="213.68.64.103" dst_ip="170.123.234.180" dst_port="42102"/>
            <filter src_ip="213.232.224.40" dst_ip="170.123.234.180" dst_port="42102"/>
        </slice>
        <from usec="0" sec="1172898000"/>
        <to usec="0" sec="1172898468"/>
    </anomaly>
    <anomaly type="suspicious" value="0.853218,1.135100,999,0 0 0 1 1 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="195.9.56.187" dst_port="53"/>
        </slice>
        <from usec="0" sec="1172898002"/>
        <to usec="0" sec="1172898451"/>
    </anomaly>
    <anomaly type="suspicious" value="0.853218,1.135100,999,0 0 0 1 1 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="153.21.8.79" dst_ip="210.49.90.72" src_port="1036" dst_port="1863"/>
            <filter src_ip="172.169.144.103" dst_ip="210.49.90.72" src_port="1962" dst_port="1863"/>
            <filter src_ip="153.21.9.74" dst_ip="210.49.90.72" src_port="3952" dst_port="1863"/>
        </slice>
        <from usec="0" sec="1172898001"/>
        <to usec="0" sec="1172898735"/>
    </anomaly>
    <anomaly type="suspicious" value="0.853218,1.135100,999,0 0 0 1 1 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="170.123.44.136" src_port="25"/>
        </slice>
        <from usec="0" sec="1172898093"/>
        <to usec="0" sec="1172898785"/>
    </anomaly>
    <anomaly type="suspicious" value="0.853218,1.135100,999,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="198.79.170.110" dst_ip="214.125.79.191" src_port="62639" dst_port="3390"/>
            <filter src_ip="198.79.170.110" dst_ip="214.125.79.191" src_port="62139" dst_port="13259"/>
        </slice>
        <from usec="0" sec="1172898715"/>
        <to usec="0" sec="1172898789"/>
    </anomaly>
    <anomaly type="suspicious" value="1.139620,1.320020,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1172898000"/>
        <to usec="0" sec="1172898558"/>
    </anomaly>
    <anomaly type="suspicious" value="1.139620,1.320020,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1172898000"/>
        <to usec="0" sec="1172898558"/>
    </anomaly>
    <anomaly type="suspicious" value="0.967362,1.140960,999,0 0 0 1 1 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="172.169.41.217" dst_port="53"/>
            <filter dst_ip="172.169.41.217" src_port="53" dst_port="52220"/>
        </slice>
        <from usec="0" sec="1172898000"/>
        <to usec="0" sec="1172898825"/>
    </anomaly>
    <anomaly type="suspicious" value="1.094650,1.205340,999,1 0 0 1 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="217.133.91.253" src_port="53"/>
        </slice>
        <from usec="0" sec="1172898000"/>
        <to usec="0" sec="1172898828"/>
    </anomaly>
    <anomaly type="suspicious" value="1.464940,1.486610,020,0 0 0 0 0 0 1 1 1 0 0 0,ntscICec">
        <slice>
            <filter src_ip="206.23.229.167"/>
        </slice>
        <from usec="0" sec="1172898000"/>
        <to usec="0" sec="1172898046"/>
    </anomaly>
    <anomaly type="suspicious" value="1.464940,1.486610,020,0 0 0 0 0 0 1 1 1 0 0 0,ntscICec">
        <slice>
            <filter src_ip="193.127.226.15"/>
        </slice>
        <from usec="0" sec="1172898000"/>
        <to usec="0" sec="1172898046"/>
    </anomaly>
    <anomaly type="suspicious" value="1.464940,1.486610,020,0 0 0 0 0 0 1 1 1 0 0 0,ntscICec">
        <slice>
            <filter src_ip="192.128.106.30"/>
        </slice>
        <from usec="0" sec="1172898000"/>
        <to usec="0" sec="1172898046"/>
    </anomaly>
    <anomaly type="suspicious" value="1.033930,1.259290,503,0 0 0 0 0 0 1 1 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="185.196.21.17" dst_port="80"/>
        </slice>
        <from usec="0" sec="1172898000"/>
        <to usec="0" sec="1172898046"/>
    </anomaly>
    <anomaly type="suspicious" value="1.033930,1.259290,011,0 0 0 0 0 0 1 1 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="185.196.21.17" dst_port="20480"/>
        </slice>
        <from usec="0" sec="1172898000"/>
        <to usec="0" sec="1172898046"/>
    </anomaly>
    <anomaly type="suspicious" value="1.464940,1.486610,010,0 0 0 0 0 0 1 1 1 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="154.200.166.204" dst_port="139"/>
        </slice>
        <from usec="0" sec="1172898000"/>
        <to usec="0" sec="1172898046"/>
    </anomaly>
    <anomaly type="suspicious" value="1.464940,1.486610,010,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="154.200.166.204" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1172898000"/>
        <to usec="0" sec="1172898046"/>
    </anomaly>
    <anomaly type="suspicious" value="1.464940,1.486610,010,0 0 0 0 0 0 1 1 1 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="154.200.166.204" dst_port="2967"/>
        </slice>
        <from usec="0" sec="1172898000"/>
        <to usec="0" sec="1172898046"/>
    </anomaly>
    <anomaly type="suspicious" value="1.033930,1.259290,010,0 0 0 0 0 0 1 1 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="154.200.165.140" dst_port="139"/>
        </slice>
        <from usec="0" sec="1172898000"/>
        <to usec="0" sec="1172898046"/>
    </anomaly>
    <anomaly type="suspicious" value="1.033930,1.259290,010,0 0 0 0 0 0 1 1 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="154.200.165.140" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1172898000"/>
        <to usec="0" sec="1172898046"/>
    </anomaly>
    <anomaly type="suspicious" value="1.033930,1.259290,010,0 0 0 0 0 0 1 1 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="154.200.165.140" dst_port="2967"/>
        </slice>
        <from usec="0" sec="1172898000"/>
        <to usec="0" sec="1172898046"/>
    </anomaly>
    <anomaly type="suspicious" value="1.464940,1.486610,010,0 0 0 0 0 0 1 1 1 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="154.200.166.224" dst_port="139"/>
        </slice>
        <from usec="0" sec="1172898000"/>
        <to usec="0" sec="1172898046"/>
    </anomaly>
    <anomaly type="suspicious" value="1.464940,1.486610,010,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="154.200.166.224" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1172898000"/>
        <to usec="0" sec="1172898046"/>
    </anomaly>
    <anomaly type="suspicious" value="1.464940,1.486610,010,0 0 0 0 0 0 1 1 1 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="154.200.166.224" dst_port="2967"/>
        </slice>
        <from usec="0" sec="1172898000"/>
        <to usec="0" sec="1172898046"/>
    </anomaly>
    <anomaly type="suspicious" value="1.464940,1.486610,002,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="5.165.99.19" src_port="22397" dst_port="137"/>
        </slice>
        <from usec="0" sec="1172898000"/>
        <to usec="0" sec="1172898046"/>
    </anomaly>
    <anomaly type="suspicious" value="1.033930,1.259290,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="214.125.74.149" dst_port="53"/>
        </slice>
        <from usec="0" sec="1172898000"/>
        <to usec="0" sec="1172898046"/>
    </anomaly>
    <anomaly type="suspicious" value="0.770719,1.116910,503,0 0 0 0 0 0 0 0 0 1 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="170.123.178.164"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.834773,1.085660,503,1 0 0 0 0 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="153.21.180.5" dst_ip="195.17.152.93"/>
            <filter dst_ip="195.17.152.93" dst_port="80"/>
            <filter src_ip="153.21.180.5" dst_ip="195.17.149.105" dst_port="80"/>
            <filter src_ip="153.21.180.5" dst_ip="195.17.149.109" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.770719,1.116910,999,0 0 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter src_ip="156.139.165.115"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.126280,1.148030,999,0 0 0 1 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="214.125.79.191" src_port="13259"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.770719,1.116910,503,0 0 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="29.43.162.20"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.787666,1.087820,503,0 0 0 1 0 0 0 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="172.169.80.165" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.770719,1.116910,503,0 0 0 0 0 0 0 0 0 1 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="153.21.8.170"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.114490,1.175630,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="172.169.50.123" dst_ip="24.51.52.147" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.114490,1.175630,999,0 0 0 0 0 0 0 0 0 1 1 0,point_to_point">
        <slice>
            <filter src_ip="185.196.136.57" dst_ip="96.156.48.126" src_port="27000"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.770719,1.116910,503,0 0 0 0 0 0 0 0 0 1 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="4.199.139.23"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.114490,1.175630,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="172.179.25.19" dst_ip="214.1.97.74" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.114490,1.175630,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="207.24.0.40" dst_ip="170.123.228.87" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.114490,1.175630,503,0 0 0 0 0 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter src_ip="182.246.208.107" dst_ip="37.169.150.221" dst_port="80"/>
            <filter src_ip="170.123.140.1" dst_ip="37.169.150.221" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.114490,1.175630,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="215.28.82.54" dst_ip="204.214.115.8" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
