<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="anomalous" value="1.698690,1.522150,503,1 1 1 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="139.130.213.219" dst_ip="160.140.43.66" src_port="2375" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.362480,1.200960,503,1 1 0 0 0 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="214.55.169.102" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.084100,1.593410,053,1 1 1 0 0 0 1 1 1 1 1 1,heavy_hitter">
        <slice>
            <filter src_ip="164.85.66.112" dst_ip="217.31.48.32" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.362480,1.200960,503,1 1 0 0 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="217.31.48.192" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.584890,1.560120,999,1 1 1 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="205.108.76.194" src_port="53599" dst_port="1026"/>
            <filter src_ip="205.108.76.194" src_port="53599" dst_port="1027"/>
        </slice>
        <from usec="0" sec="1186549283"/>
        <to usec="0" sec="1186549890"/>
    </anomaly>
    <anomaly type="anomalous" value="1.362480,1.200960,503,1 1 0 0 0 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="214.55.172.248" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.619150,1.825010,010,1 1 1 1 1 1 1 1 1 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="216.198.112.75" src_port="6000" dst_port="1433"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.340220,1.768410,503,1 1 1 1 1 1 1 1 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="215.108.71.4" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.941410,1.455830,503,1 0 0 1 1 1 1 1 1 1 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="215.108.71.4" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.091130,1.494670,503,1 1 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="145.117.16.65" dst_port="80"/>
            <filter src_ip="214.57.46.21" dst_ip="160.145.200.139" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.941410,1.455830,503,1 0 0 1 1 1 1 1 1 1 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="164.85.16.84" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.957840,1.475100,503,0 0 0 1 1 1 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="214.55.172.248" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.285210,1.532660,053,1 1 0 1 1 1 1 1 1 1 1 1,heavy_hitter">
        <slice>
            <filter src_ip="217.31.48.32" dst_ip="164.85.66.112" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.957840,1.475100,503,0 0 0 1 1 1 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="217.31.48.142" dst_ip="164.85.180.204" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.957840,1.475100,503,0 0 0 1 1 1 0 0 0 1 1 1,point_to_point">
        <slice>
            <filter src_ip="165.21.137.180" dst_ip="145.113.170.1" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.364730,1.240390,503,1 0 0 1 1 0 1 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="164.85.16.84" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.320370,1.210060,999,1 1 0 0 0 0 1 1 1 1 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="218.21.199.209" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.571210,1.182270,503,1 0 0 1 0 0 1 1 1 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="148.92.5.176" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.207260,1.176060,999,0 0 0 1 0 0 1 1 1 1 0 0,ntscUDP">
        <slice>
            <filter src_ip="145.100.213.35" dst_port="53"/>
            <filter src_ip="214.57.45.86" src_port="59749" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.906540,1.556560,999,1 1 1 1 0 0 1 1 1 1 0 0,mptp">
        <slice>
            <filter dst_ip="214.223.1.145" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.571210,1.182270,999,1 0 0 1 0 0 1 1 1 1 1 1,mptmp">
        <slice>
            <filter src_ip="164.85.16.31"/>
            <filter src_ip="164.85.16.18"/>
            <filter src_port="3124"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.792740,1.520700,999,1 1 1 1 0 0 1 1 0 1 0 0,mptmp">
        <slice>
            <filter dst_ip="195.86.217.13" dst_port="25"/>
            <filter dst_ip="192.169.166.83" dst_port="25"/>
            <filter src_ip="139.130.91.223"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.619150,1.825010,503,1 1 1 1 1 1 1 1 1 1 1 1,mptmp">
        <slice>
            <filter src_ip="148.92.230.229" dst_port="80"/>
            <filter dst_ip="217.31.51.225" dst_port="80"/>
            <filter dst_ip="217.31.51.232" dst_port="80"/>
            <filter dst_ip="217.31.51.200" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.175180,1.487450,503,1 0 0 1 1 1 1 1 1 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="134.219.191.77" dst_ip="193.237.168.135" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.970290,1.448270,503,1 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="217.31.51.250" src_port="80"/>
            <filter dst_ip="148.92.29.223" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.795710,1.438370,503,0 0 0 1 1 1 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="214.55.169.102" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.175180,1.487450,503,1 0 0 1 1 1 1 1 1 1 1 1,mptmp">
        <slice>
            <filter src_ip="217.31.51.200" src_port="80"/>
            <filter src_ip="217.31.51.232" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.247990,1.179920,999,0 0 0 0 0 0 1 1 1 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="215.108.68.194" dst_port="3128"/>
            <filter dst_ip="215.108.68.194" dst_port="3124"/>
            <filter dst_ip="215.108.68.194"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.970290,1.448270,503,1 0 0 1 1 1 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="148.92.153.123" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.168580,1.142700,503,1 0 0 0 0 0 0 0 0 1 1 1,salphfl">
        <slice>
            <filter src_ip="145.117.210.86" dst_ip="160.1.178.112" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.144120,1.586170,503,1 1 1 1 0 0 1 1 1 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="148.92.153.123" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.452630,1.191330,503,1 1 0 1 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="148.92.54.219" dst_port="80"/>
            <filter dst_ip="217.31.51.236" dst_port="80"/>
            <filter dst_ip="217.31.51.242" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.091130,1.494670,503,1 1 0 1 1 1 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="217.31.51.250" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.412000,1.191550,503,1 1 0 0 0 0 1 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="145.117.132.149" dst_port="80"/>
            <filter dst_ip="194.71.203.224" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.795710,1.438370,503,0 0 0 1 1 1 0 0 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="217.31.51.233" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.970290,1.448270,503,1 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.144120,1.586170,503,1 1 1 1 0 0 1 1 1 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="145.117.244.144" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.452630,1.191330,503,1 1 0 1 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="214.57.44.69" dst_port="80"/>
            <filter src_ip="148.92.230.5" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.858332,1.214430,503,1 1 0 0 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter src_ip="208.15.117.171" dst_ip="215.108.74.179"/>
            <filter dst_ip="215.108.74.179" dst_port="80"/>
            <filter dst_ip="215.108.74.179"/>
        </slice>
        <from usec="0" sec="1186549254"/>
        <to usec="0" sec="1186550047"/>
    </anomaly>
    <anomaly type="suspicious" value="0.945527,1.161570,503,1 1 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="145.117.118.66" dst_ip="214.118.104.202" dst_port="80"/>
            <filter src_ip="145.117.118.66" dst_ip="214.118.104.202" dst_port="20480"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.858332,1.214430,503,1 1 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="139.130.133.79" dst_ip="214.227.148.172" dst_port="80"/>
            <filter src_ip="139.130.133.79" dst_ip="214.109.44.81" dst_port="80"/>
        </slice>
        <from usec="0" sec="1186549215"/>
        <to usec="0" sec="1186549220"/>
    </anomaly>
    <anomaly type="suspicious" value="1.117050,1.155550,503,1 1 0 0 0 0 0 0 0 1 1 0,salphfl">
        <slice>
            <filter src_ip="164.85.180.204" dst_ip="217.31.48.142" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.945527,1.161570,503,1 1 0 0 0 0 0 0 0 1 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="145.117.26.77" dst_ip="193.130.120.152" dst_port="80"/>
            <filter src_ip="145.117.26.77" dst_ip="160.86.118.170" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.540940,1.567310,503,1 1 1 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="139.130.92.136" dst_ip="194.169.208.85" dst_port="80"/>
            <filter src_ip="139.130.92.136" dst_ip="165.107.245.248" dst_port="80"/>
        </slice>
        <from usec="0" sec="1186549254"/>
        <to usec="0" sec="1186549329"/>
    </anomaly>
    <anomaly type="suspicious" value="0.858332,1.214430,504,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="139.130.230.34" dst_ip="202.60.37.134" src_port="49724" dst_port="443"/>
        </slice>
        <from usec="0" sec="1186550054"/>
        <to usec="0" sec="1186550071"/>
    </anomaly>
    <anomaly type="suspicious" value="0.858332,1.214430,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="139.130.34.98" dst_ip="214.109.45.37" src_port="3925" dst_port="80"/>
            <filter src_ip="139.130.34.98" dst_ip="214.109.45.37" src_port="3924" dst_port="80"/>
        </slice>
        <from usec="0" sec="1186550025"/>
        <to usec="0" sec="1186550030"/>
    </anomaly>
    <anomaly type="suspicious" value="0.945527,1.161570,503,1 1 0 0 0 0 0 0 0 1 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="215.108.76.162" dst_ip="182.217.85.94" dst_port="80"/>
            <filter src_ip="215.108.76.162" dst_ip="182.217.82.131" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.858332,1.214430,503,1 1 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="164.85.215.106" dst_ip="203.69.129.25" dst_port="80"/>
            <filter src_ip="164.85.215.106" dst_ip="203.69.129.30" dst_port="80"/>
        </slice>
        <from usec="0" sec="1186549801"/>
        <to usec="0" sec="1186549804"/>
    </anomaly>
    <anomaly type="suspicious" value="0.858332,1.214430,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="205.102.89.70" src_port="6000" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1186549284"/>
        <to usec="0" sec="1186549287"/>
    </anomaly>
    <anomaly type="suspicious" value="0.934941,1.205120,999,1 1 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="205.109.97.44" src_port="35802" dst_port="1027"/>
            <filter src_ip="205.109.97.44" src_port="35802" dst_port="1026"/>
            <filter src_ip="205.109.97.44" src_port="34845" dst_port="1027"/>
            <filter src_ip="205.109.97.44" src_port="34845" dst_port="1026"/>
        </slice>
        <from usec="0" sec="1186549291"/>
        <to usec="0" sec="1186549497"/>
    </anomaly>
    <anomaly type="suspicious" value="1.540940,1.567310,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="214.68.23.5" src_port="38260" dst_port="22"/>
        </slice>
        <from usec="0" sec="1186549958"/>
        <to usec="0" sec="1186549963"/>
    </anomaly>
    <anomaly type="suspicious" value="1.540940,1.567310,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="201.41.211.113" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1186549801"/>
        <to usec="0" sec="1186549927"/>
    </anomaly>
    <anomaly type="suspicious" value="0.858332,1.214430,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="214.127.121.163" dst_port="139"/>
        </slice>
        <from usec="0" sec="1186549899"/>
        <to usec="0" sec="1186549911"/>
    </anomaly>
    <anomaly type="suspicious" value="0.858332,1.214430,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="160.128.235.45" dst_port="139"/>
        </slice>
        <from usec="0" sec="1186549940"/>
        <to usec="0" sec="1186549971"/>
    </anomaly>
    <anomaly type="suspicious" value="1.232440,1.328570,999,0 0 0 1 1 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="217.31.51.1" dst_ip="166.91.166.147" src_port="5004" dst_port="2682"/>
            <filter src_ip="217.31.51.1" dst_ip="166.91.166.147" src_port="5004" dst_port="2680"/>
            <filter src_ip="217.31.51.1" dst_ip="166.91.166.147" src_port="554" dst_port="2678"/>
        </slice>
        <from usec="0" sec="1186549201"/>
        <to usec="0" sec="1186549489"/>
    </anomaly>
    <anomaly type="suspicious" value="0.821177,1.158870,002,1 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="216.149.172.36" src_port="1032" dst_port="137"/>
        </slice>
        <from usec="0" sec="1186549201"/>
        <to usec="0" sec="1186549247"/>
    </anomaly>
    <anomaly type="suspicious" value="1.046570,1.205530,999,1 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="145.100.51.56" src_port="25"/>
            <filter src_ip="145.100.51.56" dst_port="25"/>
        </slice>
        <from usec="0" sec="1186549224"/>
        <to usec="0" sec="1186549476"/>
    </anomaly>
    <anomaly type="suspicious" value="0.821177,1.158870,002,1 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="203.165.7.16" src_port="2034" dst_port="137"/>
        </slice>
        <from usec="0" sec="1186549696"/>
        <to usec="0" sec="1186549742"/>
    </anomaly>
    <anomaly type="suspicious" value="1.140250,1.228290,503,0 0 0 1 0 0 1 1 1 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="149.67.44.192" dst_ip="200.111.179.224" src_port="80"/>
        </slice>
        <from usec="0" sec="1186549696"/>
        <to usec="0" sec="1186550028"/>
    </anomaly>
    <anomaly type="suspicious" value="1.022940,1.237630,020,0 0 0 0 0 0 1 1 1 0 0 0,ntscICec">
        <slice>
            <filter src_ip="204.91.246.254"/>
        </slice>
        <from usec="0" sec="1186549201"/>
        <to usec="0" sec="1186549247"/>
    </anomaly>
    <anomaly type="suspicious" value="1.022940,1.237630,020,0 0 0 0 0 0 1 1 1 0 0 0,ntscICec">
        <slice>
            <filter src_ip="165.215.242.153"/>
        </slice>
        <from usec="0" sec="1186549201"/>
        <to usec="0" sec="1186549247"/>
    </anomaly>
    <anomaly type="suspicious" value="1.259400,1.260890,999,1 1 0 0 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter dst_ip="214.223.2.159" dst_port="53"/>
            <filter dst_ip="214.223.2.145" dst_port="53"/>
        </slice>
        <from usec="0" sec="1186549201"/>
        <to usec="0" sec="1186549787"/>
    </anomaly>
    <anomaly type="suspicious" value="1.140250,1.228290,999,0 0 0 1 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_ip="214.57.46.18"/>
            <filter src_ip="214.57.45.109" dst_ip="201.196.122.193" dst_port="28221"/>
        </slice>
        <from usec="0" sec="1186549207"/>
        <to usec="0" sec="1186549935"/>
    </anomaly>
    <anomaly type="suspicious" value="1.022940,1.237630,020,0 0 0 0 0 0 1 1 1 0 0 0,ntscICec">
        <slice>
            <filter src_ip="204.91.246.254"/>
        </slice>
        <from usec="0" sec="1186549336"/>
        <to usec="0" sec="1186549382"/>
    </anomaly>
    <anomaly type="suspicious" value="1.097130,1.185810,053,0 0 0 0 0 0 1 1 1 1 0 0,mptmp">
        <slice>
            <filter src_ip="145.164.10.35" dst_port="80"/>
            <filter dst_ip="194.71.251.65" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.140250,1.228290,999,0 0 0 1 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="148.92.128.98" src_port="53"/>
            <filter src_ip="148.92.128.98" src_port="50299" dst_port="53"/>
            <filter src_ip="145.100.51.97" src_port="43012" dst_port="53"/>
        </slice>
        <from usec="0" sec="1186549201"/>
        <to usec="0" sec="1186549738"/>
    </anomaly>
    <anomaly type="suspicious" value="1.022940,1.237630,503,0 0 0 0 0 0 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="193.131.83.135" src_port="80"/>
        </slice>
        <from usec="0" sec="1186549336"/>
        <to usec="0" sec="1186549382"/>
    </anomaly>
    <anomaly type="suspicious" value="1.140250,1.228290,999,0 0 0 1 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="218.21.199.213" src_port="53"/>
        </slice>
        <from usec="0" sec="1186549201"/>
        <to usec="0" sec="1186549849"/>
    </anomaly>
    <anomaly type="suspicious" value="1.046570,1.205530,999,1 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="214.223.4.57" src_port="53"/>
        </slice>
        <from usec="0" sec="1186549336"/>
        <to usec="0" sec="1186549676"/>
    </anomaly>
    <anomaly type="suspicious" value="1.022940,1.237630,010,0 0 0 0 0 0 1 1 1 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="214.113.33.67" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1186549336"/>
        <to usec="0" sec="1186549382"/>
    </anomaly>
    <anomaly type="suspicious" value="1.022940,1.237630,010,0 0 0 0 0 0 1 1 1 0 0 0,ptpDoSSYN">
        <slice>
            <filter src_ip="160.128.4.83" dst_ip="193.131.81.64" dst_port="3128"/>
        </slice>
        <from usec="0" sec="1186549336"/>
        <to usec="0" sec="1186549742"/>
    </anomaly>
    <anomaly type="suspicious" value="1.022940,1.237630,999,0 0 0 0 0 0 1 1 1 0 0 0,alphfl">
        <slice>
            <filter src_ip="182.198.107.184" dst_ip="218.21.199.209" dst_port="53"/>
        </slice>
        <from usec="0" sec="1186549336"/>
        <to usec="0" sec="1186549382"/>
    </anomaly>
    <anomaly type="suspicious" value="1.022940,1.237630,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="145.100.51.63" src_port="53"/>
            <filter src_ip="145.100.51.63" src_port="32810" dst_port="53"/>
        </slice>
        <from usec="0" sec="1186549336"/>
        <to usec="0" sec="1186549382"/>
    </anomaly>
    <anomaly type="suspicious" value="1.046570,1.205530,999,1 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="148.92.84.241" src_port="1027" dst_port="53"/>
        </slice>
        <from usec="0" sec="1186549336"/>
        <to usec="0" sec="1186549872"/>
    </anomaly>
    <anomaly type="suspicious" value="1.140250,1.228290,999,0 0 0 1 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="218.21.199.209" src_port="53"/>
        </slice>
        <from usec="0" sec="1186549201"/>
        <to usec="0" sec="1186550025"/>
    </anomaly>
    <anomaly type="suspicious" value="1.022940,1.237630,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="149.67.238.119" src_port="123" dst_port="123"/>
        </slice>
        <from usec="0" sec="1186549336"/>
        <to usec="0" sec="1186549382"/>
    </anomaly>
    <anomaly type="suspicious" value="1.022940,1.237630,010,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="217.174.174.206" src_port="53" dst_port="1024"/>
        </slice>
        <from usec="0" sec="1186549336"/>
        <to usec="0" sec="1186549382"/>
    </anomaly>
    <anomaly type="suspicious" value="1.022940,1.237630,010,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="217.174.174.206" src_port="53" dst_port="3072"/>
            <filter src_ip="217.174.174.206" src_port="53" dst_port="1024"/>
        </slice>
        <from usec="0" sec="1186549201"/>
        <to usec="0" sec="1186549382"/>
    </anomaly>
    <anomaly type="suspicious" value="1.022940,1.237630,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="205.117.158.165" src_port="1042" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1186549336"/>
        <to usec="0" sec="1186549382"/>
    </anomaly>
    <anomaly type="suspicious" value="1.022940,1.237630,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="203.64.168.192" src_port="4567" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1186549336"/>
        <to usec="0" sec="1186549382"/>
    </anomaly>
    <anomaly type="suspicious" value="1.022940,1.237630,020,0 0 0 0 0 0 1 1 1 0 0 0,ntscICec">
        <slice>
            <filter src_ip="215.108.71.66"/>
        </slice>
        <from usec="0" sec="1186549381"/>
        <to usec="0" sec="1186549742"/>
    </anomaly>
    <anomaly type="suspicious" value="1.022940,1.237630,020,0 0 0 0 0 0 1 1 1 0 0 0,ntscICecrqICecrqdurmterp">
        <slice>
            <filter dst_ip="215.108.71.66"/>
        </slice>
        <from usec="0" sec="1186549696"/>
        <to usec="0" sec="1186549742"/>
    </anomaly>
    <anomaly type="suspicious" value="1.022940,1.237630,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="214.57.46.18" dst_port="14948"/>
        </slice>
        <from usec="0" sec="1186549696"/>
        <to usec="0" sec="1186549742"/>
    </anomaly>
    <anomaly type="suspicious" value="1.022940,1.237630,504,0 0 0 0 0 0 1 1 1 0 0 0,alphfl">
        <slice>
            <filter src_ip="139.130.128.152" dst_ip="160.91.147.138" dst_port="443"/>
        </slice>
        <from usec="0" sec="1186549696"/>
        <to usec="0" sec="1186549742"/>
    </anomaly>
    <anomaly type="suspicious" value="1.022940,1.237630,503,0 0 0 0 0 0 1 1 1 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="145.117.221.89" dst_ip="200.98.96.18" dst_port="80"/>
        </slice>
        <from usec="0" sec="1186549696"/>
        <to usec="0" sec="1186549742"/>
    </anomaly>
    <anomaly type="suspicious" value="0.884712,1.138340,503,0 0 0 0 0 0 1 1 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="148.92.31.53" dst_ip="160.140.46.98" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.046570,1.205530,999,1 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="214.223.4.57" dst_port="53"/>
        </slice>
        <from usec="0" sec="1186549201"/>
        <to usec="0" sec="1186550041"/>
    </anomaly>
    <anomaly type="suspicious" value="0.779817,1.126100,999,0 0 0 1 0 0 0 0 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="215.108.71.33" src_port="5830"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.980762,1.119900,503,0 0 0 1 0 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter src_ip="182.217.85.94" dst_ip="215.108.76.162" src_port="80"/>
            <filter src_ip="182.217.82.131" dst_ip="215.108.76.162" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.147470,1.176520,503,0 0 0 0 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="148.92.5.176" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.779817,1.126100,503,0 0 0 1 0 0 0 0 0 1 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="217.31.48.54" dst_ip="164.85.150.157" src_port="80" dst_port="3942"/>
            <filter src_ip="217.31.48.211" dst_ip="164.85.150.157" src_port="80" dst_port="3940"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.841498,1.130130,999,0 0 0 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="215.108.71.33" dst_port="5830"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.147470,1.176520,503,0 0 0 0 0 0 0 0 0 1 1 1,ptmplaHTTP">
        <slice>
            <filter src_ip="145.117.67.101" dst_ip="202.166.77.106"/>
            <filter dst_ip="202.166.77.106" src_port="80"/>
            <filter src_ip="145.117.67.101" dst_ip="193.128.65.39" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.841498,1.130130,503,0 0 0 0 0 0 0 0 0 1 1 0,salphfl">
        <slice>
            <filter src_ip="149.67.5.24" dst_ip="204.181.150.0" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.015580,1.151840,503,1 1 0 0 0 0 1 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="194.71.232.38" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.841498,1.130130,504,0 0 0 0 0 0 0 0 0 1 1 0,mptpla">
        <slice>
            <filter src_ip="148.92.25.132" dst_ip="214.36.186.103" dst_port="443"/>
            <filter src_ip="148.92.25.170" dst_ip="214.36.186.103" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.147470,1.176520,503,0 0 0 0 0 0 0 0 0 1 1 1,ptmplaHTTP">
        <slice>
            <filter src_ip="148.92.18.81" dst_ip="193.14.143.165" dst_port="80"/>
            <filter src_ip="148.92.18.81" dst_ip="210.2.213.199" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.147470,1.176520,503,0 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="148.92.11.163" dst_ip="201.58.57.133" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.117050,1.155550,503,1 1 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="164.85.229.144" dst_port="80"/>
            <filter src_ip="164.85.129.82" dst_ip="217.31.48.54" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.147470,1.176520,503,0 0 0 0 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="214.57.44.69" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.841498,1.130130,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="182.198.222.204" dst_ip="215.108.76.1" src_port="80" dst_port="40131"/>
            <filter src_ip="182.198.222.204" dst_ip="215.108.76.1" src_port="80" dst_port="40121"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.097130,1.185810,503,0 0 0 0 0 0 1 1 1 1 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="148.92.88.37" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.841498,1.130130,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="193.167.165.1" dst_ip="148.92.68.40" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.147470,1.176520,503,0 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="194.71.203.224" src_port="80"/>
            <filter dst_ip="148.92.82.227" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.841498,1.130130,504,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="194.165.45.36" dst_ip="148.92.82.143" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.147470,1.176520,503,0 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="217.31.51.204" src_port="80"/>
            <filter src_ip="217.31.51.219" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.841498,1.130130,503,0 0 0 0 0 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter src_ip="194.71.232.38" dst_ip="148.92.192.164" src_port="80"/>
            <filter src_ip="160.1.178.112" dst_ip="148.92.192.164" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.147470,1.176520,503,0 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="211.98.184.217" dst_ip="145.164.40.238" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.841498,1.130130,503,0 0 0 0 0 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter src_ip="217.31.48.60" dst_ip="164.85.180.52" src_port="80" dst_port="64659"/>
            <filter src_ip="217.31.37.194" dst_ip="164.85.180.52" src_port="80" dst_port="64691"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.147470,1.176520,503,0 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="217.31.48.192" src_port="80"/>
            <filter dst_ip="145.113.170.6" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.841498,1.130130,503,0 0 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="149.67.205.209" dst_port="80"/>
            <filter src_ip="149.67.205.209" dst_port="53"/>
            <filter dst_ip="214.227.149.104" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.841498,1.130130,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="145.117.253.30" dst_ip="193.226.142.109" src_port="2673" dst_port="80"/>
            <filter src_ip="145.117.253.30" dst_ip="193.226.142.109" src_port="2671" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.841498,1.130130,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="139.130.224.88" dst_ip="192.30.83.171" src_port="1114" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.841498,1.130130,999,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="148.92.128.98" dst_ip="203.181.220.57" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
