<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="anomalous" value="1.149030,1.109880,503,1 1 0 0 0 0 0 0 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="168.45.2.96" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.515630,1.808250,010,1 1 1 1 1 1 1 1 1 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="210.140.58.66" src_port="6000" dst_port="8080"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.667130,1.459650,503,1 1 1 0 0 0 0 0 0 1 1 0,ptmplaHTTP">
        <slice>
            <filter src_ip="134.149.169.143" dst_ip="41.120.17.252" dst_port="80"/>
            <filter src_ip="134.149.169.143" dst_ip="88.86.104.83" dst_port="80"/>
            <filter src_ip="134.149.169.143" dst_ip="198.48.2.226" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.190790,1.670460,503,1 1 1 1 1 1 1 1 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="199.181.144.212" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.149030,1.109880,503,1 1 0 0 0 0 0 0 0 1 1 0,ptmplaHTTP">
        <slice>
            <filter src_ip="134.149.6.132" dst_ip="216.136.174.24" dst_port="80"/>
            <filter src_ip="134.149.6.132" dst_ip="217.201.173.106" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.592180,1.185540,503,1 1 0 1 1 0 1 1 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="168.45.207.9" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.510970,1.489300,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="93.29.9.143" dst_port="135"/>
        </slice>
        <from usec="0" sec="1178342052"/>
        <to usec="0" sec="1178342101"/>
    </anomaly>
    <anomaly type="anomalous" value="1.510970,1.489300,002,1 1 1 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="213.71.129.139" src_port="62485" dst_port="137"/>
        </slice>
        <from usec="0" sec="1178341875"/>
        <to usec="0" sec="1178341924"/>
    </anomaly>
    <anomaly type="anomalous" value="1.510970,1.489300,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="88.117.152.190" dst_port="445"/>
            <filter src_ip="88.117.152.190" dst_port="139"/>
        </slice>
        <from usec="0" sec="1178341860"/>
        <to usec="0" sec="1178341921"/>
    </anomaly>
    <anomaly type="anomalous" value="1.956440,1.406650,503,1 0 0 1 1 1 1 1 1 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="199.181.144.212" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.956440,1.406650,503,1 0 0 1 1 1 1 1 1 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="168.45.207.9" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.195690,1.110400,503,1 0 0 1 1 0 0 0 0 1 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="199.181.152.190" src_port="21"/>
            <filter src_ip="199.181.152.190" dst_ip="210.176.164.218" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.893340,1.542790,503,1 1 1 1 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="155.255.138.3" dst_port="80"/>
            <filter src_ip="155.255.138.35" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.882350,1.422310,503,0 0 0 1 1 1 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="58.19.4.36" dst_ip="198.155.84.203" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.420560,1.230990,503,1 1 0 0 0 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="129.206.20.226" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.882350,1.422310,503,0 0 0 1 1 1 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="198.155.96.73" src_port="80"/>
            <filter dst_ip="198.155.96.73" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.926890,1.412240,503,1 0 0 1 1 1 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="199.181.155.243" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.882350,1.422310,503,0 0 0 1 1 1 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="134.128.134.12" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.978550,1.445940,503,0 0 0 1 1 1 1 1 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="198.155.86.61" src_port="80"/>
            <filter dst_ip="129.206.214.3" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.105980,1.582470,999,1 1 1 1 1 0 1 1 1 1 1 0,mptmp">
        <slice>
            <filter dst_ip="198.15.220.192" dst_port="53"/>
            <filter dst_ip="198.15.222.89" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.042450,1.444830,999,1 1 0 1 1 1 1 1 1 1 1 0,mptmp">
        <slice>
            <filter src_ip="199.181.146.69"/>
            <filter src_port="3128"/>
            <filter src_port="3124"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.314090,1.177010,503,0 0 0 1 0 0 1 1 1 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="129.206.193.158" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.538610,1.298830,503,1 1 0 1 1 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_ip="198.155.86.61" dst_port="80"/>
            <filter src_ip="172.113.168.139" dst_port="80"/>
            <filter src_ip="172.113.168.138" dst_port="80"/>
        </slice>
        <from usec="0" sec="1178341200"/>
        <to usec="0" sec="1178342101"/>
    </anomaly>
    <anomaly type="anomalous" value="2.078560,1.587450,503,1 1 1 1 1 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="13.227.2.33" dst_port="80"/>
            <filter dst_ip="13.227.2.43" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.289250,1.729270,503,1 1 1 1 1 1 1 1 1 1 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="199.181.152.190" dst_port="21"/>
            <filter src_ip="210.176.164.218" dst_ip="199.181.152.190" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.194970,1.094520,504,1 1 0 1 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter dst_port="443"/>
            <filter src_ip="168.45.3.54" dst_port="80"/>
            <filter dst_ip="13.227.2.58" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.284530,1.121350,999,0 0 0 1 1 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="198.150.162.206" src_port="10572"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.269670,1.183690,503,0 0 0 1 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="204.169.136.65" dst_ip="129.206.193.158" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.014160,1.450280,503,1 1 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="13.227.2.33" src_port="80"/>
            <filter dst_ip="129.206.45.95" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.226530,1.197910,503,0 0 0 0 0 0 0 0 0 1 1 1,mptplaHTTP">
        <slice>
            <filter src_ip="217.106.193.36" dst_ip="134.128.20.203" src_port="80"/>
            <filter src_ip="217.106.173.159" dst_ip="134.128.20.203" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.882350,1.422310,503,0 0 0 1 1 1 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="155.255.86.154" dst_port="80"/>
            <filter src_ip="155.255.86.154" src_port="43607" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.127300,1.504040,503,1 0 0 1 1 1 1 1 1 1 1 1,ptmplaHTTP">
        <slice>
            <filter src_ip="145.206.128.130" dst_ip="210.176.160.28" src_port="80"/>
            <filter src_ip="145.206.128.130" dst_ip="89.88.84.48" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.226530,1.197910,503,0 0 0 0 0 0 0 0 0 1 1 1,ptmplaHTTP">
        <slice>
            <filter src_ip="134.149.218.27" dst_ip="208.90.232.133" src_port="80"/>
            <filter src_ip="134.149.218.27" dst_ip="92.5.114.135" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.926890,1.412240,503,1 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="13.227.2.42" src_port="80"/>
            <filter src_ip="198.48.0.143" dst_ip="168.45.3.54" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.226530,1.197910,503,0 0 0 0 0 0 0 0 0 1 1 1,salphfl">
        <slice>
            <filter src_ip="134.149.73.81" dst_ip="216.136.135.4" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.226530,1.197910,503,0 0 0 0 0 0 0 0 0 1 1 1,mptplaHTTP">
        <slice>
            <filter dst_ip="168.45.3.102" src_port="80"/>
            <filter dst_ip="168.45.3.102" src_port="8080"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.226530,1.197910,503,0 0 0 0 0 0 0 0 0 1 1 1,salphfl">
        <slice>
            <filter src_ip="13.227.2.45" dst_ip="129.206.178.34" src_port="80" dst_port="1050"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.532230,1.241340,503,0 0 0 1 1 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="88.234.193.75" src_port="80"/>
            <filter dst_ip="129.206.162.213" src_port="80"/>
            <filter dst_ip="129.206.162.213" src_port="25"/>
            <filter dst_ip="129.206.162.213" dst_port="25"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.226530,1.197910,503,0 0 0 0 0 0 0 0 0 1 1 1,mptplaHTTP">
        <slice>
            <filter src_ip="89.225.69.128" dst_ip="168.45.2.96"/>
            <filter src_ip="89.225.69.128" src_port="80"/>
            <filter dst_ip="168.45.2.96" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.226530,1.197910,503,0 0 0 0 0 0 0 0 0 1 1 1,malphfl">
        <slice>
            <filter src_ip="199.251.10.201" dst_ip="168.45.111.170" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.226530,1.197910,503,0 0 0 0 0 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="155.255.149.230" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.226530,1.197910,503,0 0 0 0 0 0 0 0 0 1 1 1,mptplaHTTP">
        <slice>
            <filter src_ip="168.45.237.152" dst_ip="53.217.89.211" src_port="80"/>
            <filter src_ip="134.128.70.93" dst_ip="53.217.89.211" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.843480,1.146000,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="198.155.84.203" dst_ip="58.19.4.36" src_port="2136" dst_port="80"/>
        </slice>
        <from usec="0" sec="1178342067"/>
        <to usec="0" sec="1178342093"/>
    </anomaly>
    <anomaly type="suspicious" value="0.843480,1.146000,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="129.206.1.1" dst_ip="56.155.232.39" src_port="2345" dst_port="80"/>
        </slice>
        <from usec="0" sec="1178342070"/>
        <to usec="0" sec="1178342093"/>
    </anomaly>
    <anomaly type="suspicious" value="0.843480,1.146000,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="134.128.117.64" dst_ip="13.227.2.45" src_port="1119" dst_port="80"/>
        </slice>
        <from usec="0" sec="1178341539"/>
        <to usec="0" sec="1178341558"/>
    </anomaly>
    <anomaly type="suspicious" value="0.843480,1.146000,504,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="58.40.84.81" dst_ip="199.181.156.124" src_port="40772" dst_port="443"/>
        </slice>
        <from usec="0" sec="1178341290"/>
        <to usec="0" sec="1178341303"/>
    </anomaly>
    <anomaly type="suspicious" value="0.843480,1.146000,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="129.206.9.49" dst_ip="53.153.223.206" src_port="3885" dst_port="80"/>
        </slice>
        <from usec="0" sec="1178342058"/>
        <to usec="0" sec="1178342084"/>
    </anomaly>
    <anomaly type="suspicious" value="0.843480,1.146000,503,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="134.128.20.210" dst_ip="200.164.196.42" src_port="3311" dst_port="80"/>
        </slice>
        <from usec="0" sec="1178342077"/>
        <to usec="0" sec="1178342099"/>
    </anomaly>
    <anomaly type="suspicious" value="0.843480,1.146000,503,1 1 0 0 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="199.181.155.243" dst_port="80"/>
        </slice>
        <from usec="0" sec="1178341224"/>
        <to usec="0" sec="1178342071"/>
    </anomaly>
    <anomaly type="suspicious" value="0.843480,1.146000,503,1 1 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="168.45.76.197" dst_ip="56.155.243.245" src_port="1042" dst_port="80"/>
            <filter src_ip="168.45.76.197" dst_ip="56.155.243.245" src_port="1041" dst_port="80"/>
            <filter src_ip="168.45.76.197" dst_ip="56.155.243.40" src_port="1040" dst_port="80"/>
            <filter src_ip="168.45.76.197" dst_ip="56.155.234.140" src_port="1064" dst_port="80"/>
        </slice>
        <from usec="0" sec="1178342064"/>
        <to usec="0" sec="1178342068"/>
    </anomaly>
    <anomaly type="suspicious" value="0.843480,1.146000,999,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="145.206.172.226" dst_ip="199.105.111.217" src_port="1391" dst_port="554"/>
        </slice>
        <from usec="0" sec="1178342064"/>
        <to usec="0" sec="1178342090"/>
    </anomaly>
    <anomaly type="suspicious" value="1.473260,1.487290,999,1 1 1 0 0 0 0 0 0 0 0 0,ipv4gretun">
        <slice>
            <filter src_ip="199.144.110.217" dst_ip="198.155.84.179"/>
            <filter src_ip="198.219.170.31" dst_ip="198.155.84.179"/>
            <filter src_ip="209.128.130.133" dst_ip="198.155.84.179" src_port="51411" dst_port="1026"/>
            <filter src_ip="199.221.28.242" dst_ip="198.155.84.179"/>
        </slice>
        <from usec="0" sec="1178341555"/>
        <to usec="0" sec="1178342048"/>
    </anomaly>
    <anomaly type="suspicious" value="0.843480,1.146000,503,1 1 0 0 0 0 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="129.206.109.5" dst_ip="13.227.2.45" dst_port="80"/>
        </slice>
        <from usec="0" sec="1178342064"/>
        <to usec="0" sec="1178342068"/>
    </anomaly>
    <anomaly type="suspicious" value="0.843480,1.146000,002,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="220.193.200.147" src_port="1090" dst_port="137"/>
        </slice>
        <from usec="0" sec="1178341549"/>
        <to usec="0" sec="1178341556"/>
    </anomaly>
    <anomaly type="suspicious" value="0.843480,1.146000,002,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="42.158.173.147" src_port="10043" dst_port="137"/>
        </slice>
        <from usec="0" sec="1178341259"/>
        <to usec="0" sec="1178341274"/>
    </anomaly>
    <anomaly type="suspicious" value="0.843480,1.146000,002,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="89.117.64.92" src_port="1029" dst_port="137"/>
        </slice>
        <from usec="0" sec="1178341696"/>
        <to usec="0" sec="1178341710"/>
    </anomaly>
    <anomaly type="suspicious" value="0.843480,1.146000,002,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="197.227.13.196" src_port="62336" dst_port="137"/>
        </slice>
        <from usec="0" sec="1178341976"/>
        <to usec="0" sec="1178341990"/>
    </anomaly>
    <anomaly type="suspicious" value="0.843480,1.146000,002,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="196.253.28.106" dst_port="137"/>
        </slice>
        <from usec="0" sec="1178341603"/>
        <to usec="0" sec="1178341617"/>
    </anomaly>
    <anomaly type="suspicious" value="1.234480,1.257390,010,1 1 0 0 0 0 1 1 1 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="12.196.33.239" dst_port="445"/>
            <filter src_ip="12.196.33.239" dst_port="139"/>
        </slice>
        <from usec="0" sec="1178341256"/>
        <to usec="0" sec="1178341336"/>
    </anomaly>
    <anomaly type="suspicious" value="1.473260,1.487290,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="197.196.224.56" dst_port="445"/>
        </slice>
        <from usec="0" sec="1178341922"/>
        <to usec="0" sec="1178341944"/>
    </anomaly>
    <anomaly type="suspicious" value="0.843480,1.146000,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="214.146.94.37" dst_port="445"/>
        </slice>
        <from usec="0" sec="1178341201"/>
        <to usec="0" sec="1178341228"/>
    </anomaly>
    <anomaly type="suspicious" value="0.843480,1.146000,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="196.54.183.161" dst_port="139"/>
            <filter src_ip="196.54.183.161" dst_port="445"/>
        </slice>
        <from usec="0" sec="1178341344"/>
        <to usec="0" sec="1178341531"/>
    </anomaly>
    <anomaly type="suspicious" value="0.843480,1.146000,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDPUDPICrp">
        <slice>
            <filter dst_ip="134.2.1.139"/>
        </slice>
        <from usec="0" sec="1178341558"/>
        <to usec="0" sec="1178341561"/>
    </anomaly>
    <anomaly type="suspicious" value="0.843480,1.146000,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDPUDPICrp">
        <slice>
            <filter dst_ip="199.181.204.230"/>
        </slice>
        <from usec="0" sec="1178341558"/>
        <to usec="0" sec="1178341561"/>
    </anomaly>
    <anomaly type="suspicious" value="1.020400,1.157100,503,0 0 0 1 1 0 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="54.128.40.12" dst_ip="129.206.1.100" dst_port="80"/>
        </slice>
        <from usec="0" sec="1178341285"/>
        <to usec="0" sec="1178341842"/>
    </anomaly>
    <anomaly type="suspicious" value="1.020400,1.157100,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="198.155.86.61" dst_ip="219.153.52.56" dst_port="80"/>
        </slice>
        <from usec="0" sec="1178341367"/>
        <to usec="0" sec="1178341806"/>
    </anomaly>
    <anomaly type="suspicious" value="1.134760,1.199280,999,1 0 0 1 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="202.49.4.152" src_port="53"/>
        </slice>
        <from usec="0" sec="1178341200"/>
        <to usec="0" sec="1178342101"/>
    </anomaly>
    <anomaly type="suspicious" value="1.234480,1.257390,999,1 1 0 0 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_ip="209.146.11.251" dst_ip="168.45.207.114"/>
            <filter src_ip="209.146.11.251" dst_ip="199.181.146.68"/>
            <filter src_ip="209.146.11.251" dst_port="3124"/>
            <filter src_ip="209.146.11.251" dst_port="3128"/>
            <filter src_ip="209.146.11.251" dst_port="3127"/>
            <filter dst_ip="168.45.207.114" dst_port="3124"/>
            <filter dst_ip="168.45.207.114" dst_port="3128"/>
            <filter dst_ip="199.181.146.68" dst_port="3124"/>
        </slice>
        <from usec="0" sec="1178341200"/>
        <to usec="0" sec="1178342101"/>
    </anomaly>
    <anomaly type="suspicious" value="1.057370,1.211120,999,0 0 0 1 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="129.206.59.200" src_port="53"/>
            <filter src_ip="129.206.59.200" src_port="54873" dst_port="53"/>
        </slice>
        <from usec="0" sec="1178341201"/>
        <to usec="0" sec="1178341571"/>
    </anomaly>
    <anomaly type="suspicious" value="1.005160,1.225030,020,0 0 0 0 0 0 1 1 1 0 0 0,icmp_error">
        <slice>
            <filter src_ip="172.113.169.53"/>
        </slice>
        <from usec="0" sec="1178341290"/>
        <to usec="0" sec="1178342101"/>
    </anomaly>
    <anomaly type="suspicious" value="1.005160,1.225030,020,0 0 0 0 0 0 1 1 1 0 0 0,hostout">
        <slice>
            <filter src_ip="168.45.192.152"/>
        </slice>
        <from usec="0" sec="1178341290"/>
        <to usec="0" sec="1178341336"/>
    </anomaly>
    <anomaly type="suspicious" value="1.005160,1.225030,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="145.206.203.84" src_port="45343"/>
        </slice>
        <from usec="0" sec="1178341290"/>
        <to usec="0" sec="1178342101"/>
    </anomaly>
    <anomaly type="suspicious" value="1.005160,1.225030,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="209.128.130.133" src_port="48022" dst_port="1026"/>
            <filter src_ip="209.128.130.133" src_port="48022" dst_port="1027"/>
        </slice>
        <from usec="0" sec="1178341290"/>
        <to usec="0" sec="1178341336"/>
    </anomaly>
    <anomaly type="suspicious" value="1.005160,1.225030,999,0 0 0 0 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_ip="203.70.111.196" dst_ip="168.45.207.126"/>
            <filter src_ip="203.70.111.196" dst_port="3128"/>
            <filter dst_ip="168.45.207.126" dst_port="43829"/>
            <filter dst_ip="168.45.207.126" dst_port="3128"/>
        </slice>
        <from usec="0" sec="1178341200"/>
        <to usec="0" sec="1178341336"/>
    </anomaly>
    <anomaly type="suspicious" value="1.005160,1.225030,020,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="196.74.218.26"/>
        </slice>
        <from usec="0" sec="1178341290"/>
        <to usec="0" sec="1178341336"/>
    </anomaly>
    <anomaly type="suspicious" value="1.005160,1.225030,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="129.206.209.107" src_port="52663" dst_port="53"/>
        </slice>
        <from usec="0" sec="1178341290"/>
        <to usec="0" sec="1178342101"/>
    </anomaly>
    <anomaly type="suspicious" value="1.005160,1.225030,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="199.181.146.68" src_port="27303"/>
        </slice>
        <from usec="0" sec="1178341200"/>
        <to usec="0" sec="1178341381"/>
    </anomaly>
    <anomaly type="suspicious" value="1.005160,1.225030,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="202.49.4.156" src_port="53"/>
        </slice>
        <from usec="0" sec="1178341290"/>
        <to usec="0" sec="1178342101"/>
    </anomaly>
    <anomaly type="suspicious" value="1.057370,1.211120,999,0 0 0 1 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="128.122.163.132" src_port="123" dst_port="123"/>
        </slice>
        <from usec="0" sec="1178341290"/>
        <to usec="0" sec="1178341758"/>
    </anomaly>
    <anomaly type="suspicious" value="1.057370,1.211120,999,0 0 0 1 0 0 1 1 1 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="198.15.217.57" dst_ip="192.168.200.5" src_port="53"/>
        </slice>
        <from usec="0" sec="1178341200"/>
        <to usec="0" sec="1178342027"/>
    </anomaly>
    <anomaly type="suspicious" value="1.005160,1.225030,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="134.33.163.65" src_port="6881"/>
        </slice>
        <from usec="0" sec="1178341290"/>
        <to usec="0" sec="1178341336"/>
    </anomaly>
    <anomaly type="suspicious" value="1.005160,1.225030,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="198.155.85.5" src_port="61679" dst_port="53"/>
        </slice>
        <from usec="0" sec="1178341290"/>
        <to usec="0" sec="1178341336"/>
    </anomaly>
    <anomaly type="suspicious" value="1.005160,1.225030,503,0 0 0 0 0 0 1 1 1 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="134.128.20.53" dst_ip="193.16.201.65" dst_port="80"/>
        </slice>
        <from usec="0" sec="1178341290"/>
        <to usec="0" sec="1178341336"/>
    </anomaly>
    <anomaly type="suspicious" value="1.005160,1.225030,010,0 0 0 0 0 0 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="209.154.220.134" src_port="80"/>
        </slice>
        <from usec="0" sec="1178341290"/>
        <to usec="0" sec="1178341336"/>
    </anomaly>
    <anomaly type="suspicious" value="1.005160,1.225030,501,0 0 0 0 0 0 1 1 1 0 0 0,ptmpla">
        <slice>
            <filter src_ip="198.234.142.45" dst_ip="199.181.144.159" dst_port="21"/>
            <filter src_ip="198.234.142.45" dst_ip="199.181.157.0" dst_port="21"/>
        </slice>
        <from usec="0" sec="1178341290"/>
        <to usec="0" sec="1178341336"/>
    </anomaly>
    <anomaly type="suspicious" value="1.005160,1.225030,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="134.128.134.87" src_port="37828" dst_port="53"/>
        </slice>
        <from usec="0" sec="1178341290"/>
        <to usec="0" sec="1178341336"/>
    </anomaly>
    <anomaly type="suspicious" value="1.005160,1.225030,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="172.113.168.151" src_port="64498" dst_port="53"/>
        </slice>
        <from usec="0" sec="1178341290"/>
        <to usec="0" sec="1178341336"/>
    </anomaly>
    <anomaly type="suspicious" value="1.005160,1.225030,010,0 0 0 0 0 0 1 1 1 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="145.206.173.118" dst_port="2967"/>
        </slice>
        <from usec="0" sec="1178341290"/>
        <to usec="0" sec="1178341336"/>
    </anomaly>
    <anomaly type="suspicious" value="1.005160,1.225030,999,0 0 0 0 0 0 1 1 1 0 0 0,heavy_hitter">
        <slice>
            <filter src_ip="12.3.53.99" dst_ip="199.181.146.69" dst_port="3128"/>
        </slice>
        <from usec="0" sec="1178341290"/>
        <to usec="0" sec="1178341336"/>
    </anomaly>
    <anomaly type="suspicious" value="1.005160,1.225030,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="134.128.10.164" src_port="53"/>
        </slice>
        <from usec="0" sec="1178341290"/>
        <to usec="0" sec="1178341921"/>
    </anomaly>
    <anomaly type="suspicious" value="1.005160,1.225030,999,0 0 0 0 0 0 1 1 1 0 0 0,heavy_hitter">
        <slice>
            <filter src_ip="210.145.176.202" dst_ip="199.181.146.75" dst_port="3127"/>
        </slice>
        <from usec="0" sec="1178341290"/>
        <to usec="0" sec="1178342101"/>
    </anomaly>
    <anomaly type="suspicious" value="1.005160,1.225030,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="134.128.10.134" dst_port="53"/>
        </slice>
        <from usec="0" sec="1178341290"/>
        <to usec="0" sec="1178341336"/>
    </anomaly>
    <anomaly type="suspicious" value="1.021170,1.114420,999,1 1 0 0 0 0 1 0 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="199.181.157.4" dst_port="42063"/>
            <filter dst_ip="199.181.157.4"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.724111,1.059120,503,0 0 0 1 0 0 0 0 0 1 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="129.206.162.213" dst_port="25"/>
            <filter src_ip="129.206.162.213" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.956216,1.057180,503,0 0 0 1 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="129.206.233.173" dst_ip="56.156.186.186" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.887726,1.106060,999,0 0 0 0 0 0 1 1 0 1 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="217.17.144.116" dst_ip="129.206.216.1"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.041160,1.043590,503,1 0 0 1 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="134.128.134.12" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.887726,1.106060,020,0 0 0 0 0 0 1 1 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="199.181.157.18"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.898143,1.073080,999,0 0 0 0 0 0 0 0 0 1 1 0,ptmpla">
        <slice>
            <filter src_ip="75.158.184.37" dst_ip="129.206.90.58" dst_port="53"/>
            <filter src_ip="75.158.184.37" dst_ip="129.206.90.58" dst_port="995"/>
            <filter src_ip="75.158.184.37" dst_ip="129.206.90.210" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.956216,1.057180,503,0 0 0 1 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="134.128.134.221" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.988089,1.059690,503,1 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="134.149.133.255" dst_ip="216.217.11.170" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.898143,1.073080,503,0 0 0 0 0 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter src_ip="134.128.134.80" dst_ip="54.150.41.186" src_port="80" dst_port="40025"/>
            <filter src_ip="134.128.134.80" dst_ip="54.150.41.186" src_port="80" dst_port="39924"/>
            <filter src_ip="134.128.177.21" dst_ip="54.150.41.186" src_port="80" dst_port="34885"/>
            <filter src_ip="134.128.177.21" dst_ip="54.150.41.186" src_port="80" dst_port="34880"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
