<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="anomalous" value="1.924360,1.452080,503,1 1 0 1 1 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="200.142.218.168" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.171300,1.683250,503,1 1 1 1 1 1 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="201.107.75.133" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.025160,1.645340,501,1 1 1 0 0 0 1 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="201.107.65.100" dst_port="21"/>
            <filter src_ip="212.222.162.27" dst_ip="201.107.65.100" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.567220,1.358200,503,1 1 1 0 0 0 0 0 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="152.162.140.74" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.241420,1.989890,010,1 1 1 1 1 0 1 1 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="220.10.58.104" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1175662800"/>
        <to usec="0" sec="1175663538"/>
    </anomaly>
    <anomaly type="anomalous" value="1.685890,1.443730,503,1 1 0 0 0 0 1 0 0 0 1 1,mptmp">
        <slice>
            <filter src_ip="42.7.39.166" src_port="80"/>
            <filter dst_ip="200.142.234.7" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.931700,1.631900,504,1 1 1 1 1 1 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="219.247.144.110" dst_ip="152.162.92.61"/>
            <filter src_ip="206.179.108.114" dst_ip="152.162.92.61" src_port="443"/>
        </slice>
        <from usec="0" sec="1175662800"/>
        <to usec="0" sec="1175663628"/>
    </anomaly>
    <anomaly type="anomalous" value="1.567220,1.358200,503,1 1 1 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="200.142.200.170" dst_ip="206.179.20.113" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.920550,1.558360,503,1 1 1 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="42.7.39.154" dst_ip="152.162.86.134" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.219730,1.163850,504,1 1 0 1 1 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="152.162.92.61" dst_ip="206.179.108.114" dst_port="443"/>
            <filter src_ip="152.162.92.61" dst_ip="218.208.70.50" dst_port="80"/>
        </slice>
        <from usec="0" sec="1175662800"/>
        <to usec="0" sec="1175663669"/>
    </anomaly>
    <anomaly type="anomalous" value="1.459620,1.164030,999,1 0 0 1 1 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="200.130.28.192" src_port="15463"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.810890,1.484010,999,1 0 0 1 1 1 1 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="201.107.72.183"/>
            <filter src_ip="200.130.156.167" src_port="25783"/>
            <filter src_ip="200.130.156.167" src_port="29912" dst_port="33434"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.866120,1.437810,503,1 0 0 1 1 1 0 0 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="34.123.244.57" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.171350,1.628220,503,1 0 0 1 1 1 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="136.220.151.211" dst_ip="80.131.232.176" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.573870,1.270370,503,1 0 0 1 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="34.123.244.53" src_port="80"/>
            <filter dst_ip="152.162.129.231" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.171350,1.628220,503,1 0 0 1 1 1 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="219.46.131.238" dst_ip="152.162.34.51" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.809220,1.701560,999,1 0 0 1 0 0 1 1 0 1 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="194.132.230.212" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.115670,1.014920,999,1 0 0 1 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="158.150.57.77" src_port="25"/>
            <filter dst_ip="158.150.57.77" dst_port="25"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.569010,1.407500,503,0 0 0 1 1 1 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="201.107.66.150" src_port="80"/>
        </slice>
        <from usec="0" sec="1175662800"/>
        <to usec="0" sec="1175663628"/>
    </anomaly>
    <anomaly type="anomalous" value="1.573870,1.270370,503,1 0 0 1 0 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="152.162.145.98" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.380780,1.380040,999,1 1 1 1 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="209.113.131.124" src_port="59581" dst_port="1026"/>
            <filter src_ip="209.113.131.124" src_port="59581" dst_port="1027"/>
            <filter src_ip="209.113.131.73" src_port="50040" dst_port="1026"/>
            <filter src_ip="209.113.131.73" src_port="50040" dst_port="1027"/>
        </slice>
        <from usec="0" sec="1175662800"/>
        <to usec="0" sec="1175663538"/>
    </anomaly>
    <anomaly type="anomalous" value="1.833800,1.392390,503,1 0 0 1 1 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="200.130.25.66" dst_ip="219.154.118.131" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.573870,1.270370,503,1 0 0 1 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="169.22.104.211" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.693100,1.386950,503,1 0 0 1 1 1 0 0 0 1 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="201.107.75.133" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.856040,1.466720,503,0 0 0 1 1 1 0 0 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="152.162.86.161" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.580930,1.377350,502,1 0 0 1 1 1 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="217.34.175.132" src_port="22"/>
        </slice>
        <from usec="0" sec="1175662800"/>
        <to usec="0" sec="1175663538"/>
    </anomaly>
    <anomaly type="anomalous" value="1.810890,1.484010,502,1 0 0 1 1 1 1 0 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="217.34.175.132" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.171350,1.628220,503,1 0 0 1 1 1 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="152.162.34.51" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.162690,1.653800,503,0 0 0 1 1 1 0 0 0 1 1 1,ptmplaHTTP">
        <slice>
            <filter src_ip="169.22.38.151" src_port="26351"/>
            <filter src_ip="169.22.38.151" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.801770,1.743140,999,1 1 0 1 0 0 1 1 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="212.148.1.244" dst_ip="201.107.72.183"/>
            <filter src_ip="212.148.1.244" dst_ip="201.107.72.186"/>
            <filter src_ip="212.148.1.244" dst_ip="201.107.72.187"/>
            <filter src_ip="212.148.1.244" dst_port="3128"/>
            <filter dst_ip="201.107.72.183" dst_port="3128"/>
            <filter dst_ip="201.107.72.186" dst_port="3128"/>
            <filter dst_ip="201.107.72.187" dst_port="3128"/>
        </slice>
        <from usec="0" sec="1175662800"/>
        <to usec="0" sec="1175663695"/>
    </anomaly>
    <anomaly type="anomalous" value="1.937590,1.810410,999,0 0 0 1 1 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="200.18.154.25" dst_port="53"/>
        </slice>
        <from usec="0" sec="1175662800"/>
        <to usec="0" sec="1175663538"/>
    </anomaly>
    <anomaly type="anomalous" value="1.704710,1.693740,999,1 0 0 1 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="200.18.152.14" dst_port="53"/>
        </slice>
        <from usec="0" sec="1175662800"/>
        <to usec="0" sec="1175663656"/>
    </anomaly>
    <anomaly type="anomalous" value="1.797270,1.436070,503,1 1 0 1 0 0 1 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="32.215.155.89" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.162690,1.653800,503,0 0 0 1 1 1 0 0 0 1 1 1,ptmplaHTTP">
        <slice>
            <filter src_ip="12.24.206.28" dst_ip="158.150.57.163" src_port="80"/>
            <filter src_ip="12.24.206.28" dst_ip="200.130.28.34" src_port="80"/>
            <filter src_ip="12.24.206.28" dst_ip="152.162.145.98" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.162690,1.653800,503,0 0 0 1 1 1 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="12.24.205.1" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.446700,1.199550,503,0 0 0 1 1 0 0 0 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="169.22.104.211" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.162690,1.653800,503,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="169.22.236.128" src_port="80"/>
            <filter dst_ip="200.130.155.236" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.516530,2.106510,010,1 1 1 0 0 0 1 1 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="210.134.48.131" dst_port="25"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.259000,1.095390,503,1 1 0 1 0 0 0 0 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="34.123.244.53" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.569010,1.407500,503,0 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="12.24.205.0" dst_ip="152.162.86.137" src_port="80"/>
        </slice>
        <from usec="0" sec="1175662801"/>
        <to usec="0" sec="1175663266"/>
    </anomaly>
    <anomaly type="anomalous" value="1.106360,1.038600,503,1 0 0 0 0 0 0 0 0 1 1 0,point_to_point">
        <slice>
            <filter src_ip="173.104.144.114" dst_ip="12.24.205.1" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.089270,1.078260,503,0 0 0 0 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="152.162.145.98" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.561900,1.303000,053,0 0 0 1 0 0 0 0 0 1 1 1,point_to_point">
        <slice>
            <filter src_ip="12.24.206.197" dst_ip="158.50.225.5" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.162690,1.653800,503,0 0 0 1 1 1 0 0 0 1 1 1,malphfl">
        <slice>
            <filter src_ip="12.24.206.196" dst_ip="169.22.38.151" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.162690,1.653800,503,0 0 0 1 1 1 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="219.154.118.131" dst_ip="200.130.25.66" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.573870,1.270370,503,1 0 0 1 0 0 0 0 0 1 1 1,heavy_hitter">
        <slice>
            <filter src_ip="201.107.65.100" dst_ip="212.222.162.27" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.171350,1.628220,503,1 0 0 1 1 1 0 0 0 1 1 1,ptmplaHTTP">
        <slice>
            <filter src_ip="158.135.13.196" dst_ip="80.148.193.173" src_port="80"/>
            <filter src_ip="158.135.13.196" dst_ip="219.201.58.180" src_port="873"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.089270,1.078260,503,0 0 0 0 0 0 0 0 0 1 1 0,salphfl">
        <slice>
            <filter src_ip="152.162.142.187" dst_ip="65.130.24.37" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.089270,1.078260,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="218.107.73.134" dst_ip="152.162.222.142" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.089270,1.078260,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="219.131.169.217" dst_ip="158.50.3.181" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.089270,1.078260,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="42.7.39.145" dst_ip="152.162.86.39" src_port="80" dst_port="1580"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.089270,1.078260,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="215.209.16.203" dst_ip="152.162.140.74" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.089270,1.078260,503,0 0 0 0 0 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter dst_ip="152.162.44.193" src_port="80"/>
            <filter src_ip="207.63.2.213" dst_ip="152.162.44.193" src_port="443"/>
            <filter dst_ip="152.162.44.193" src_port="123" dst_port="123"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.098730,1.055470,503,0 0 0 1 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="158.129.147.88" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.115670,1.014920,503,1 0 0 1 0 0 0 0 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="152.162.112.146" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.259000,1.095390,503,1 1 0 1 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="158.135.144.87" dst_port="80"/>
            <filter dst_ip="200.48.197.23" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.779874,0.966966,503,1 0 0 0 0 0 0 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="201.107.76.195" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.821224,1.067010,999,1 0 0 1 0 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="201.107.72.187" src_port="3128"/>
            <filter src_ip="201.107.72.187" dst_ip="34.97.234.57" src_port="3124"/>
        </slice>
        <from usec="0" sec="1175662802"/>
        <to usec="0" sec="1175663623"/>
    </anomaly>
    <anomaly type="suspicious" value="0.762429,1.038400,999,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="209.113.131.122" src_port="52322" dst_port="1026"/>
            <filter src_ip="209.113.131.122" src_port="52322" dst_port="1027"/>
        </slice>
        <from usec="0" sec="1175662874"/>
        <to usec="0" sec="1175662880"/>
    </anomaly>
    <anomaly type="suspicious" value="0.762429,1.038400,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="158.135.181.118" dst_ip="200.48.203.225" src_port="59054" dst_port="80"/>
            <filter src_ip="158.135.181.118" dst_ip="200.48.203.225" src_port="51888" dst_port="80"/>
            <filter src_ip="158.135.181.118" dst_ip="200.48.203.225" src_port="39292" dst_port="80"/>
            <filter src_ip="158.135.181.118" dst_ip="200.48.203.225" src_port="33584" dst_port="80"/>
        </slice>
        <from usec="0" sec="1175663408"/>
        <to usec="0" sec="1175663416"/>
    </anomaly>
    <anomaly type="suspicious" value="0.762429,1.038400,503,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="152.163.0.172" dst_ip="83.58.97.50" src_port="32792" dst_port="80"/>
        </slice>
        <from usec="0" sec="1175663318"/>
        <to usec="0" sec="1175663329"/>
    </anomaly>
    <anomaly type="suspicious" value="0.762429,1.038400,503,1 1 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="201.107.70.46" dst_ip="33.31.68.245" src_port="80"/>
            <filter src_ip="201.107.70.46" dst_ip="33.31.68.246" src_port="80"/>
        </slice>
        <from usec="0" sec="1175662800"/>
        <to usec="0" sec="1175663692"/>
    </anomaly>
    <anomaly type="suspicious" value="0.762429,1.038400,503,1 1 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="152.162.145.194" dst_ip="48.151.39.19" src_port="1874" dst_port="80"/>
            <filter src_ip="152.162.145.194" dst_ip="48.151.39.19" src_port="1868" dst_port="80"/>
            <filter src_ip="152.162.145.194" dst_ip="48.151.39.19" src_port="1867" dst_port="80"/>
            <filter src_ip="152.162.145.194" dst_ip="48.151.39.19" src_port="1853" dst_port="80"/>
            <filter src_ip="152.162.145.194" dst_ip="217.175.255.74" src_port="1869" dst_port="80"/>
        </slice>
        <from usec="0" sec="1175663281"/>
        <to usec="0" sec="1175663287"/>
    </anomaly>
    <anomaly type="suspicious" value="0.762429,1.038400,002,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="102.113.2.40" src_port="51039" dst_port="137"/>
        </slice>
        <from usec="0" sec="1175663169"/>
        <to usec="0" sec="1175663193"/>
    </anomaly>
    <anomaly type="suspicious" value="0.762429,1.038400,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="158.135.168.225" dst_ip="200.48.202.179" dst_port="80"/>
        </slice>
        <from usec="0" sec="1175663647"/>
        <to usec="0" sec="1175663684"/>
    </anomaly>
    <anomaly type="suspicious" value="0.762429,1.038400,503,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="152.162.86.103" dst_ip="81.188.151.152" dst_port="80"/>
        </slice>
        <from usec="0" sec="1175663046"/>
        <to usec="0" sec="1175663645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.762429,1.038400,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="200.130.149.209" dst_ip="201.17.36.233" dst_port="80"/>
        </slice>
        <from usec="0" sec="1175662862"/>
        <to usec="0" sec="1175662926"/>
    </anomaly>
    <anomaly type="suspicious" value="1.213720,1.294020,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="80.210.107.177" src_port="38908" dst_port="1026"/>
            <filter src_ip="80.210.107.177" src_port="38908" dst_port="1027"/>
            <filter src_ip="80.210.107.177" src_port="36135" dst_port="1026"/>
            <filter src_ip="80.210.107.177" src_port="36135" dst_port="1027"/>
        </slice>
        <from usec="0" sec="1175663292"/>
        <to usec="0" sec="1175663659"/>
    </anomaly>
    <anomaly type="suspicious" value="0.762429,1.038400,002,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="203.154.93.119" src_port="1025" dst_port="137"/>
        </slice>
        <from usec="0" sec="1175663633"/>
        <to usec="0" sec="1175663646"/>
    </anomaly>
    <anomaly type="suspicious" value="0.762429,1.038400,999,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="209.113.131.126" src_port="52860" dst_port="1026"/>
            <filter src_ip="209.113.131.126" src_port="52860" dst_port="1027"/>
        </slice>
        <from usec="0" sec="1175663585"/>
        <to usec="0" sec="1175663588"/>
    </anomaly>
    <anomaly type="suspicious" value="0.775881,1.014720,002,1 1 0 1 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="52.122.171.162" src_port="61358" dst_port="137"/>
        </slice>
        <from usec="0" sec="1175663306"/>
        <to usec="0" sec="1175663538"/>
    </anomaly>
    <anomaly type="suspicious" value="0.762429,1.038400,002,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="52.96.24.129" src_port="1412" dst_port="137"/>
        </slice>
        <from usec="0" sec="1175663509"/>
        <to usec="0" sec="1175663522"/>
    </anomaly>
    <anomaly type="suspicious" value="0.762429,1.038400,999,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="9.112.125.103" dst_port="1026"/>
        </slice>
        <from usec="0" sec="1175663536"/>
        <to usec="0" sec="1175663538"/>
    </anomaly>
    <anomaly type="suspicious" value="0.762429,1.038400,999,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="171.221.47.100" dst_port="1026"/>
        </slice>
        <from usec="0" sec="1175663536"/>
        <to usec="0" sec="1175663538"/>
    </anomaly>
    <anomaly type="suspicious" value="1.213720,1.294020,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="203.160.137.166" dst_port="445"/>
        </slice>
        <from usec="0" sec="1175663137"/>
        <to usec="0" sec="1175663143"/>
    </anomaly>
    <anomaly type="suspicious" value="0.762429,1.038400,999,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="172.36.213.68" dst_port="1026"/>
        </slice>
        <from usec="0" sec="1175663536"/>
        <to usec="0" sec="1175663538"/>
    </anomaly>
    <anomaly type="suspicious" value="1.213720,1.294020,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="200.223.154.72" dst_port="135"/>
        </slice>
        <from usec="0" sec="1175662861"/>
        <to usec="0" sec="1175662866"/>
    </anomaly>
    <anomaly type="suspicious" value="1.213720,1.294020,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="133.34.223.168" dst_port="1026"/>
        </slice>
        <from usec="0" sec="1175663535"/>
        <to usec="0" sec="1175663539"/>
    </anomaly>
    <anomaly type="suspicious" value="0.762429,1.038400,999,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="86.2.51.116" dst_port="1026"/>
        </slice>
        <from usec="0" sec="1175663536"/>
        <to usec="0" sec="1175663537"/>
    </anomaly>
    <anomaly type="suspicious" value="1.213720,1.294020,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="170.249.137.181" dst_port="1026"/>
        </slice>
        <from usec="0" sec="1175663536"/>
        <to usec="0" sec="1175663538"/>
    </anomaly>
    <anomaly type="suspicious" value="0.762429,1.038400,999,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="78.134.26.214" dst_port="1026"/>
        </slice>
        <from usec="0" sec="1175663536"/>
        <to usec="0" sec="1175663537"/>
    </anomaly>
    <anomaly type="suspicious" value="1.213720,1.294020,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="82.47.13.49" dst_port="1026"/>
        </slice>
        <from usec="0" sec="1175663536"/>
        <to usec="0" sec="1175663537"/>
    </anomaly>
    <anomaly type="suspicious" value="0.762429,1.038400,999,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="90.29.26.176" dst_port="1026"/>
        </slice>
        <from usec="0" sec="1175663559"/>
        <to usec="0" sec="1175663560"/>
    </anomaly>
    <anomaly type="suspicious" value="0.762429,1.038400,999,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="20.217.115.12" dst_port="1026"/>
        </slice>
        <from usec="0" sec="1175663536"/>
        <to usec="0" sec="1175663537"/>
    </anomaly>
    <anomaly type="suspicious" value="1.213720,1.294020,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="35.146.99.193" dst_port="1026"/>
        </slice>
        <from usec="0" sec="1175663536"/>
        <to usec="0" sec="1175663537"/>
    </anomaly>
    <anomaly type="suspicious" value="1.213720,1.294020,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="203.66.235.151" dst_port="1026"/>
        </slice>
        <from usec="0" sec="1175663536"/>
        <to usec="0" sec="1175663538"/>
    </anomaly>
    <anomaly type="suspicious" value="0.762429,1.038400,999,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="114.217.105.71" dst_port="1026"/>
        </slice>
        <from usec="0" sec="1175663536"/>
        <to usec="0" sec="1175663537"/>
    </anomaly>
    <anomaly type="suspicious" value="0.762429,1.038400,999,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="86.237.237.63" dst_port="1026"/>
        </slice>
        <from usec="0" sec="1175663535"/>
        <to usec="0" sec="1175663537"/>
    </anomaly>
    <anomaly type="suspicious" value="0.762429,1.038400,999,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="153.232.132.82" dst_port="1026"/>
        </slice>
        <from usec="0" sec="1175663536"/>
        <to usec="0" sec="1175663537"/>
    </anomaly>
    <anomaly type="suspicious" value="0.762429,1.038400,503,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="12.24.206.202" dst_ip="169.22.5.75" src_port="80" dst_port="1754"/>
            <filter src_ip="12.24.206.202" dst_ip="169.22.5.75" src_port="80" dst_port="1753"/>
        </slice>
        <from usec="0" sec="1175662858"/>
        <to usec="0" sec="1175662861"/>
    </anomaly>
    <anomaly type="suspicious" value="1.213720,1.294020,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="203.109.119.192" dst_port="1026"/>
        </slice>
        <from usec="0" sec="1175663557"/>
        <to usec="0" sec="1175663560"/>
    </anomaly>
    <anomaly type="suspicious" value="1.213720,1.294020,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="203.156.217.94" dst_port="135"/>
        </slice>
        <from usec="0" sec="1175663482"/>
        <to usec="0" sec="1175663485"/>
    </anomaly>
    <anomaly type="suspicious" value="1.213720,1.294020,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="173.227.181.126" dst_port="1026"/>
        </slice>
        <from usec="0" sec="1175662834"/>
        <to usec="0" sec="1175662837"/>
    </anomaly>
    <anomaly type="suspicious" value="0.762429,1.038400,999,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="206.228.122.12" dst_port="1026"/>
        </slice>
        <from usec="0" sec="1175663535"/>
        <to usec="0" sec="1175663536"/>
    </anomaly>
    <anomaly type="suspicious" value="1.213720,1.294020,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="208.8.98.30" dst_port="135"/>
        </slice>
        <from usec="0" sec="1175663365"/>
        <to usec="0" sec="1175663370"/>
    </anomaly>
    <anomaly type="suspicious" value="0.762429,1.038400,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="59.19.153.14" dst_port="135"/>
        </slice>
        <from usec="0" sec="1175662800"/>
        <to usec="0" sec="1175663700"/>
    </anomaly>
    <anomaly type="suspicious" value="1.213720,1.294020,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="136.144.235.226" dst_port="1026"/>
        </slice>
        <from usec="0" sec="1175663536"/>
        <to usec="0" sec="1175663537"/>
    </anomaly>
    <anomaly type="suspicious" value="1.213720,1.294020,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="112.114.61.239" dst_port="1026"/>
        </slice>
        <from usec="0" sec="1175663557"/>
        <to usec="0" sec="1175663560"/>
    </anomaly>
    <anomaly type="suspicious" value="0.762429,1.038400,999,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="214.21.191.205" dst_port="1026"/>
        </slice>
        <from usec="0" sec="1175662836"/>
        <to usec="0" sec="1175662838"/>
    </anomaly>
    <anomaly type="suspicious" value="0.762429,1.038400,999,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="34.227.97.167" dst_port="1026"/>
        </slice>
        <from usec="0" sec="1175663536"/>
        <to usec="0" sec="1175663537"/>
    </anomaly>
    <anomaly type="suspicious" value="1.213720,1.294020,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="38.147.87.126" dst_port="1026"/>
        </slice>
        <from usec="0" sec="1175663559"/>
        <to usec="0" sec="1175663563"/>
    </anomaly>
    <anomaly type="suspicious" value="1.213720,1.294020,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="43.3.42.150" dst_port="1026"/>
        </slice>
        <from usec="0" sec="1175663536"/>
        <to usec="0" sec="1175663537"/>
    </anomaly>
    <anomaly type="suspicious" value="0.762429,1.038400,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="203.141.186.48" dst_port="135"/>
        </slice>
        <from usec="0" sec="1175663573"/>
        <to usec="0" sec="1175663586"/>
    </anomaly>
    <anomaly type="suspicious" value="1.213720,1.294020,999,1 1 1 0 0 0 0 0 0 0 0 0,ipv4gretun">
        <slice>
            <filter src_ip="201.85.13.65" dst_ip="200.142.217.5"/>
            <filter src_ip="200.242.94.88" dst_ip="200.142.217.5"/>
            <filter src_ip="201.3.57.207" dst_ip="200.142.217.5"/>
            <filter src_ip="200.198.212.228" dst_ip="200.142.217.5"/>
            <filter src_ip="201.145.230.94" dst_ip="200.142.217.5"/>
        </slice>
        <from usec="0" sec="1175662993"/>
        <to usec="0" sec="1175663165"/>
    </anomaly>
    <anomaly type="suspicious" value="1.213720,1.294020,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="204.234.104.20" dst_port="1026"/>
        </slice>
        <from usec="0" sec="1175662858"/>
        <to usec="0" sec="1175662861"/>
    </anomaly>
    <anomaly type="suspicious" value="1.213720,1.294020,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="8.224.128.230" dst_port="1026"/>
        </slice>
        <from usec="0" sec="1175663536"/>
        <to usec="0" sec="1175663537"/>
    </anomaly>
    <anomaly type="suspicious" value="1.213720,1.294020,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="8.38.136.43" dst_port="1026"/>
        </slice>
        <from usec="0" sec="1175663536"/>
        <to usec="0" sec="1175663537"/>
    </anomaly>
    <anomaly type="suspicious" value="0.769005,0.985068,503,0 0 0 1 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="218.41.248.67" dst_ip="200.142.200.170" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.808526,1.089550,503,1 0 0 0 0 0 1 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="158.150.57.163" dst_port="80"/>
        </slice>
        <from usec="0" sec="1175662820"/>
        <to usec="0" sec="1175663367"/>
    </anomaly>
    <anomaly type="suspicious" value="1.053510,1.126370,503,0 0 0 1 1 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="158.50.79.12" dst_port="80"/>
        </slice>
        <from usec="0" sec="1175662800"/>
        <to usec="0" sec="1175663358"/>
    </anomaly>
    <anomaly type="suspicious" value="1.053510,1.126370,999,0 0 0 1 1 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="152.162.213.221" dst_ip="203.155.33.170" src_port="51651" dst_port="4662"/>
        </slice>
        <from usec="0" sec="1175662801"/>
        <to usec="0" sec="1175663537"/>
    </anomaly>
    <anomaly type="suspicious" value="1.053510,1.126370,504,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="200.142.218.169" dst_ip="41.24.71.41" src_port="62094" dst_port="443"/>
        </slice>
        <from usec="0" sec="1175662813"/>
        <to usec="0" sec="1175663526"/>
    </anomaly>
    <anomaly type="suspicious" value="0.784975,1.127420,010,0 0 0 0 0 0 1 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="216.19.228.176" dst_port="5900"/>
        </slice>
        <from usec="0" sec="1175662890"/>
        <to usec="0" sec="1175662936"/>
    </anomaly>
    <anomaly type="suspicious" value="0.798048,1.105650,999,0 0 0 1 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="194.132.230.212" src_port="53"/>
        </slice>
        <from usec="0" sec="1175662803"/>
        <to usec="0" sec="1175663538"/>
    </anomaly>
    <anomaly type="suspicious" value="0.784975,1.127420,010,0 0 0 0 0 0 1 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="218.235.193.112" dst_port="5900"/>
        </slice>
        <from usec="0" sec="1175662890"/>
        <to usec="0" sec="1175662936"/>
    </anomaly>
    <anomaly type="suspicious" value="0.784975,1.127420,010,0 0 0 0 0 0 1 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="112.228.82.153" dst_port="5900"/>
        </slice>
        <from usec="0" sec="1175662890"/>
        <to usec="0" sec="1175662936"/>
    </anomaly>
    <anomaly type="suspicious" value="0.784975,1.127420,999,0 0 0 0 0 0 1 0 0 0 0 0,mptmp">
        <slice>
            <filter dst_port="1026"/>
            <filter src_port="53" dst_port="1026"/>
            <filter src_ip="209.164.40.17" src_port="56796" dst_port="1026"/>
            <filter src_ip="209.164.40.17" src_port="56796" dst_port="1027"/>
        </slice>
        <from usec="0" sec="1175662890"/>
        <to usec="0" sec="1175662936"/>
    </anomaly>
    <anomaly type="suspicious" value="0.798048,1.105650,020,0 0 0 1 0 0 1 0 0 0 0 0,ntscUDPUDPICrp">
        <slice>
            <filter dst_ip="201.107.68.33" dst_port="22365"/>
            <filter dst_ip="201.107.68.33"/>
        </slice>
        <from usec="0" sec="1175662800"/>
        <to usec="0" sec="1175663538"/>
    </anomaly>
    <anomaly type="suspicious" value="0.784975,1.127420,020,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPICdurp">
        <slice>
            <filter dst_ip="13.82.176.95"/>
        </slice>
        <from usec="0" sec="1175663025"/>
        <to usec="0" sec="1175663071"/>
    </anomaly>
    <anomaly type="suspicious" value="1.002060,1.117590,999,0 0 0 1 0 0 1 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="158.150.57.77" src_port="25"/>
            <filter src_ip="158.150.57.77" dst_port="25"/>
            <filter src_ip="158.150.216.192" dst_port="25"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.798048,1.105650,503,0 0 0 1 0 0 1 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="200.142.218.217" dst_port="80"/>
        </slice>
        <from usec="0" sec="1175662800"/>
        <to usec="0" sec="1175663071"/>
    </anomaly>
    <anomaly type="suspicious" value="0.784975,1.127420,503,0 0 0 0 0 0 1 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="152.162.218.147" dst_port="80"/>
        </slice>
        <from usec="0" sec="1175663025"/>
        <to usec="0" sec="1175663071"/>
    </anomaly>
    <anomaly type="suspicious" value="0.784975,1.127420,503,0 0 0 0 0 0 1 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="152.162.186.85" dst_port="80"/>
        </slice>
        <from usec="0" sec="1175663025"/>
        <to usec="0" sec="1175663071"/>
    </anomaly>
    <anomaly type="suspicious" value="1.698630,1.708030,999,1 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="209.113.131.69" src_port="40989" dst_port="1026"/>
            <filter src_ip="209.113.131.69" src_port="40989" dst_port="1027"/>
        </slice>
        <from usec="0" sec="1175663025"/>
        <to usec="0" sec="1175663071"/>
    </anomaly>
    <anomaly type="suspicious" value="0.808526,1.089550,002,1 0 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="13.82.176.95" src_port="1032" dst_port="137"/>
        </slice>
        <from usec="0" sec="1175663025"/>
        <to usec="0" sec="1175663071"/>
    </anomaly>
    <anomaly type="suspicious" value="0.784975,1.127420,002,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="13.82.176.176" dst_port="137"/>
        </slice>
        <from usec="0" sec="1175663025"/>
        <to usec="0" sec="1175663071"/>
    </anomaly>
    <anomaly type="suspicious" value="0.784975,1.127420,503,0 0 0 0 0 0 1 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="152.162.69.57" dst_ip="219.90.162.90" dst_port="80"/>
        </slice>
        <from usec="0" sec="1175663025"/>
        <to usec="0" sec="1175663071"/>
    </anomaly>
    <anomaly type="suspicious" value="1.687550,1.732430,503,0 0 0 0 0 0 1 1 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="169.22.135.254" dst_ip="12.24.205.110" dst_port="80"/>
        </slice>
        <from usec="0" sec="1175663025"/>
        <to usec="0" sec="1175663116"/>
    </anomaly>
    <anomaly type="suspicious" value="0.784975,1.127420,503,0 0 0 0 0 0 1 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="169.22.220.27" dst_ip="218.208.70.50" dst_port="80"/>
            <filter src_ip="152.162.145.101" dst_ip="218.208.70.50" dst_port="80"/>
        </slice>
        <from usec="0" sec="1175663205"/>
        <to usec="0" sec="1175663251"/>
    </anomaly>
    <anomaly type="suspicious" value="0.784975,1.127420,503,0 0 0 0 0 0 1 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="201.39.137.195" dst_port="80"/>
        </slice>
        <from usec="0" sec="1175663205"/>
        <to usec="0" sec="1175663251"/>
    </anomaly>
    <anomaly type="suspicious" value="0.784975,1.127420,503,0 0 0 0 0 0 1 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter dst_ip="218.107.102.15" dst_port="80"/>
        </slice>
        <from usec="0" sec="1175663205"/>
        <to usec="0" sec="1175663251"/>
    </anomaly>
    <anomaly type="suspicious" value="0.784975,1.127420,503,0 0 0 0 0 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="152.162.148.70"/>
        </slice>
        <from usec="0" sec="1175663340"/>
        <to usec="0" sec="1175663386"/>
    </anomaly>
    <anomaly type="suspicious" value="0.784975,1.127420,503,0 0 0 0 0 0 1 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="214.79.86.169"/>
        </slice>
        <from usec="0" sec="1175663340"/>
        <to usec="0" sec="1175663386"/>
    </anomaly>
    <anomaly type="suspicious" value="0.784975,1.127420,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="81.18.95.47" dst_port="1026"/>
            <filter src_ip="81.18.95.47" dst_port="1027"/>
        </slice>
        <from usec="0" sec="1175663385"/>
        <to usec="0" sec="1175663431"/>
    </anomaly>
    <anomaly type="suspicious" value="0.784975,1.127420,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="81.22.44.168"/>
        </slice>
        <from usec="0" sec="1175663385"/>
        <to usec="0" sec="1175663431"/>
    </anomaly>
    <anomaly type="suspicious" value="0.808526,1.089550,010,1 0 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="200.193.168.204" dst_port="1433"/>
            <filter src_ip="200.193.168.204" dst_port="135"/>
        </slice>
        <from usec="0" sec="1175663385"/>
        <to usec="0" sec="1175663431"/>
    </anomaly>
    <anomaly type="suspicious" value="0.808526,1.089550,010,1 0 0 0 0 0 1 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="200.93.38.7" dst_port="139"/>
        </slice>
        <from usec="0" sec="1175663385"/>
        <to usec="0" sec="1175663441"/>
    </anomaly>
    <anomaly type="suspicious" value="0.784975,1.127420,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="81.22.44.179" src_port="36729" dst_port="1026"/>
            <filter src_ip="81.22.44.179" src_port="36729" dst_port="1027"/>
        </slice>
        <from usec="0" sec="1175663430"/>
        <to usec="0" sec="1175663476"/>
    </anomaly>
    <anomaly type="suspicious" value="0.784975,1.127420,002,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="83.180.182.120" src_port="1027"/>
        </slice>
        <from usec="0" sec="1175663430"/>
        <to usec="0" sec="1175663476"/>
    </anomaly>
    <anomaly type="suspicious" value="0.784975,1.127420,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="158.150.153.169" src_port="53" dst_port="32769"/>
        </slice>
        <from usec="0" sec="1175663385"/>
        <to usec="0" sec="1175663476"/>
    </anomaly>
    <anomaly type="suspicious" value="0.784975,1.127420,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="200.142.216.20" dst_port="53"/>
        </slice>
        <from usec="0" sec="1175663610"/>
        <to usec="0" sec="1175663656"/>
    </anomaly>
    <anomaly type="suspicious" value="0.784975,1.127420,503,0 0 0 0 0 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="158.150.57.3"/>
        </slice>
        <from usec="0" sec="1175663610"/>
        <to usec="0" sec="1175663656"/>
    </anomaly>
    <anomaly type="suspicious" value="0.784975,1.127420,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="200.142.216.102" dst_port="53"/>
        </slice>
        <from usec="0" sec="1175663610"/>
        <to usec="0" sec="1175663656"/>
    </anomaly>
    <anomaly type="suspicious" value="0.784975,1.127420,503,0 0 0 0 0 0 1 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="32.21.119.132"/>
        </slice>
        <from usec="0" sec="1175663610"/>
        <to usec="0" sec="1175663656"/>
    </anomaly>
    <anomaly type="suspicious" value="0.784975,1.127420,010,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="12.52.14.20"/>
        </slice>
        <from usec="0" sec="1175663610"/>
        <to usec="0" sec="1175663656"/>
    </anomaly>
    <anomaly type="suspicious" value="0.784975,1.127420,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="200.142.217.193"/>
        </slice>
        <from usec="0" sec="1175663610"/>
        <to usec="0" sec="1175663656"/>
    </anomaly>
    <anomaly type="suspicious" value="1.698630,1.708030,503,1 0 0 0 0 0 1 1 0 0 0 0,heavy_hitter">
        <slice>
            <filter src_ip="152.162.108.54" dst_ip="154.78.226.82" dst_port="80"/>
        </slice>
        <from usec="0" sec="1175663025"/>
        <to usec="0" sec="1175663656"/>
    </anomaly>
    <anomaly type="suspicious" value="0.784975,1.127420,503,0 0 0 0 0 0 1 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="169.22.187.49" dst_ip="218.208.68.232" dst_port="80"/>
            <filter src_ip="158.150.57.163" dst_ip="218.208.68.232" dst_port="80"/>
        </slice>
        <from usec="0" sec="1175663610"/>
        <to usec="0" sec="1175663656"/>
    </anomaly>
    <anomaly type="suspicious" value="1.687550,1.732430,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="194.132.230.208" dst_port="53"/>
        </slice>
        <from usec="0" sec="1175662800"/>
        <to usec="0" sec="1175662846"/>
    </anomaly>
    <anomaly type="suspicious" value="1.693670,1.718340,503,0 0 0 1 0 0 1 1 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="152.162.36.145" dst_ip="80.131.213.58" dst_port="80"/>
        </slice>
        <from usec="0" sec="1175662800"/>
        <to usec="0" sec="1175662880"/>
    </anomaly>
    <anomaly type="suspicious" value="1.687550,1.732430,020,0 0 0 0 0 0 1 1 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="219.247.144.110"/>
        </slice>
        <from usec="0" sec="1175663070"/>
        <to usec="0" sec="1175663116"/>
    </anomaly>
    <anomaly type="suspicious" value="0.779874,0.966966,503,1 0 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="152.163.28.88" dst_ip="201.39.138.139" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.755430,1.009440,503,0 0 0 0 0 0 0 0 0 1 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="158.135.10.188"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.769005,0.985068,011,0 0 0 1 0 0 0 0 0 1 0 0,heavy_hitter">
        <slice>
            <filter src_ip="129.78.6.123" dst_ip="212.155.27.114" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.755430,1.009440,999,0 0 0 0 0 0 0 0 0 1 0 0,ntscUDP">
        <slice>
            <filter src_ip="218.197.176.123"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.769005,0.985068,503,0 0 0 1 0 0 0 0 0 1 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="65.130.24.37" dst_ip="152.162.142.187" src_port="80"/>
            <filter src_ip="216.8.115.204" dst_ip="152.162.142.187" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.973931,1.051110,503,1 1 0 0 0 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="55.26.177.8" dst_port="1026"/>
            <filter src_ip="218.107.112.148" dst_ip="158.150.15.85" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.755430,1.009440,503,0 0 0 0 0 0 0 0 0 1 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="170.182.15.191"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.779874,0.966966,503,1 0 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="200.48.202.115" dst_ip="169.22.194.168" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.755430,1.009440,999,0 0 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter dst_ip="192.168.10.19"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.769005,0.985068,503,0 0 0 1 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="214.5.166.203" dst_ip="200.142.218.169" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.755430,1.009440,999,0 0 0 0 0 0 0 0 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="201.107.75.145"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.755430,1.009440,503,0 0 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter dst_ip="204.200.88.180"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.779874,0.966966,503,1 0 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="152.162.222.142" dst_ip="218.107.73.134" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.755430,1.009440,503,0 0 0 0 0 0 0 0 0 1 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="173.104.144.114" dst_ip="12.24.205.0" dst_port="80"/>
            <filter src_ip="152.162.86.137" dst_ip="12.24.205.0" dst_port="80"/>
            <filter src_ip="200.142.218.217" dst_ip="12.24.205.0" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.755430,1.009440,999,0 0 0 0 0 0 0 0 0 1 0 0,mptpla">
        <slice>
            <filter dst_ip="34.14.47.147"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.755430,1.009440,999,0 0 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter dst_ip="48.54.22.108"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.821224,1.067010,503,1 0 0 1 0 0 1 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="200.142.218.172" dst_port="80"/>
            <filter dst_ip="201.150.87.64" dst_port="80"/>
        </slice>
        <from usec="0" sec="1175662800"/>
        <to usec="0" sec="1175663669"/>
    </anomaly>
</admd:annotation>
