<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="anomalous" value="1.506070,1.341600,999,1 1 1 1 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="208.194.233.53" src_port="53"/>
        </slice>
        <from usec="0" sec="1189314001"/>
        <to usec="0" sec="1189314851"/>
    </anomaly>
    <anomaly type="anomalous" value="1.232010,1.213680,999,1 1 1 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter src_ip="129.29.6.102" dst_ip="200.78.217.16" dst_port="25"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.746420,1.442110,999,1 1 0 1 1 1 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="128.190.169.176" src_port="19101"/>
            <filter src_ip="128.190.169.176" dst_ip="32.39.114.87" dst_port="19101"/>
        </slice>
        <from usec="0" sec="1189314001"/>
        <to usec="0" sec="1189314899"/>
    </anomaly>
    <anomaly type="anomalous" value="2.000230,1.482580,503,1 1 1 1 1 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="217.155.106.58" dst_ip="16.149.1.176" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.287320,1.227240,010,1 1 1 0 0 0 1 0 0 1 0 0,ntscSYNt">
        <slice>
            <filter src_ip="0.141.214.171" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.972260,1.521520,503,1 1 1 1 1 0 1 1 1 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="168.206.244.245" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.397680,1.709640,010,1 1 1 1 1 1 1 1 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="76.14.164.76" src_port="6000" dst_port="5168"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.942510,1.528530,010,1 1 1 0 0 0 1 1 1 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="77.5.98.0" src_port="6000" dst_port="5168"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.748720,1.371890,503,1 1 1 1 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="128.190.247.110" dst_port="80"/>
            <filter dst_ip="33.117.131.40" dst_port="80"/>
            <filter dst_ip="200.78.134.123" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.369200,1.228370,503,1 1 1 1 0 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="128.190.86.228" dst_port="80"/>
            <filter dst_ip="96.154.188.5" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.547560,1.423670,999,1 1 1 0 0 0 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="217.155.106.246"/>
        </slice>
        <from usec="0" sec="1189314001"/>
        <to usec="0" sec="1189314767"/>
    </anomaly>
    <anomaly type="anomalous" value="1.633870,1.426720,999,0 0 0 1 1 1 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="217.155.104.100" dst_ip="217.162.182.192" src_port="8001" dst_port="8001"/>
            <filter src_ip="217.155.104.100" dst_ip="217.162.182.192" src_port="1637" dst_port="8000"/>
        </slice>
        <from usec="0" sec="1189314001"/>
        <to usec="0" sec="1189314829"/>
    </anomaly>
    <anomaly type="anomalous" value="2.011960,1.531370,503,0 0 0 1 1 1 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="16.149.1.176" dst_ip="217.155.106.58" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.117810,1.549570,503,1 1 1 1 1 1 1 0 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="168.206.244.245" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.748720,1.371890,503,1 1 1 1 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="128.190.65.180" dst_port="80"/>
            <filter src_ip="128.190.27.176" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.675980,1.438270,999,0 0 0 1 1 1 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="134.112.181.128" src_port="61364"/>
        </slice>
        <from usec="0" sec="1189314001"/>
        <to usec="0" sec="1189314642"/>
    </anomaly>
    <anomaly type="anomalous" value="2.104380,1.545720,503,1 1 0 1 1 1 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="129.29.40.174" dst_ip="197.43.80.16" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.011960,1.531370,503,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="128.190.65.180" src_port="80"/>
            <filter dst_ip="128.190.27.176" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.798190,1.420440,503,0 0 0 1 1 1 0 0 0 1 1 0,malphfl">
        <slice>
            <filter src_ip="33.117.148.89" dst_ip="168.206.7.210" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.011960,1.531370,503,0 0 0 1 1 1 0 0 0 1 1 1,salphfl">
        <slice>
            <filter src_ip="200.78.134.123" dst_ip="168.206.6.66" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.692530,1.404250,503,0 0 0 1 1 1 0 0 0 1 0 0,salphfl">
        <slice>
            <filter src_ip="216.6.216.164" dst_ip="128.190.125.41" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.798190,1.420440,503,0 0 0 1 1 1 0 0 0 1 1 0,malphfl">
        <slice>
            <filter src_ip="33.117.148.209" dst_ip="168.206.6.34" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.358200,1.227810,999,0 0 0 1 1 0 1 0 0 1 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="216.212.114.51"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.716650,1.413890,999,1 1 1 1 0 0 1 1 1 1 0 0,mptmp">
        <slice>
            <filter dst_ip="208.194.233.53" dst_port="53"/>
            <filter dst_ip="216.98.214.249" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.363160,1.287220,999,1 1 0 0 0 0 1 1 1 1 0 0,mptp">
        <slice>
            <filter dst_ip="201.27.107.58" dst_port="25"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.302080,1.651850,010,1 1 1 1 1 1 1 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="197.11.3.217" src_port="12200" dst_port="6588"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.327650,1.690640,999,1 1 1 1 1 1 1 1 1 1 1 0,mptmp">
        <slice>
            <filter src_ip="217.155.101.67" dst_ip="76.238.10.16"/>
            <filter src_ip="217.155.101.72" src_port="3128"/>
            <filter src_ip="217.155.101.72"/>
            <filter src_ip="217.155.101.72"/>
            <filter src_ip="217.155.101.66" dst_ip="76.238.10.16"/>
            <filter dst_ip="76.238.10.16" src_port="3128"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.358900,1.287840,503,0 0 0 0 0 0 1 1 1 1 1 0,mptplaHTTP">
        <slice>
            <filter src_ip="221.131.19.161" dst_ip="134.100.119.198" src_port="80"/>
            <filter src_ip="77.69.119.151" dst_ip="134.100.119.198" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.547560,1.423670,999,1 1 1 0 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_ip="76.238.10.16" dst_ip="217.155.101.67"/>
            <filter src_ip="76.238.10.16" dst_port="3128"/>
            <filter src_ip="76.238.10.16" dst_port="3124"/>
            <filter dst_ip="217.155.101.67"/>
            <filter dst_ip="217.155.101.67" dst_port="3128"/>
            <filter dst_ip="217.155.101.67"/>
            <filter dst_ip="217.155.101.67" dst_port="3124"/>
        </slice>
        <from usec="0" sec="1189314001"/>
        <to usec="0" sec="1189314870"/>
    </anomaly>
    <anomaly type="anomalous" value="2.011960,1.531370,503,0 0 0 1 1 1 0 0 0 1 1 1,mptplaHTTP">
        <slice>
            <filter src_ip="122.90.145.178" dst_ip="168.206.198.194" src_port="80"/>
            <filter src_ip="199.84.186.78" dst_ip="168.206.198.194" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.011960,1.531370,503,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="26.30.38.6" dst_ip="216.212.114.200" src_port="80"/>
            <filter src_ip="33.117.131.29" dst_ip="217.155.107.29" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.264550,1.673090,020,1 0 0 1 1 1 1 1 1 1 1 1,ntscICec">
        <slice>
            <filter src_ip="8.2.140.132"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.263710,1.208200,503,1 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="168.206.7.116" dst_port="80"/>
            <filter src_ip="168.206.6.34" dst_ip="33.117.148.209" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.271610,1.641800,503,1 1 1 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="168.206.198.194" dst_port="80"/>
            <filter dst_ip="198.29.155.32" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.506070,1.341600,020,1 1 1 1 0 0 1 1 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="218.117.181.96"/>
        </slice>
        <from usec="0" sec="1189314019"/>
        <to usec="0" sec="1189314820"/>
    </anomaly>
    <anomaly type="anomalous" value="1.403330,1.240950,020,1 1 0 0 0 0 0 0 0 1 1 1,icmp_error">
        <slice>
            <filter dst_ip="0.141.214.171" src_port="22"/>
            <filter src_ip="134.112.161.89"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.260520,1.223030,503,0 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="33.117.130.86" dst_ip="134.112.226.250" src_port="80" dst_port="1299"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.260520,1.223030,503,0 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="134.99.176.179" dst_ip="196.241.90.179" src_port="80" dst_port="4884"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.260520,1.223030,502,0 0 0 0 0 0 0 0 0 1 1 1,mptpla">
        <slice>
            <filter src_ip="134.99.182.148" dst_ip="194.101.155.192" src_port="22"/>
            <filter src_ip="134.99.172.32" dst_ip="194.101.155.192" src_port="993"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.260520,1.223030,503,0 0 0 0 0 0 0 0 0 1 1 1,ptmplaHTTP">
        <slice>
            <filter src_ip="157.25.10.153" dst_ip="20.102.172.62" src_port="80"/>
            <filter src_ip="157.25.10.153" dst_ip="77.86.50.178" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.260520,1.223030,503,0 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="128.190.86.228" src_port="80"/>
            <filter src_ip="96.154.188.5" dst_ip="128.190.7.10" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.260520,1.223030,503,0 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="196.248.55.51" dst_ip="134.112.166.196" src_port="49451" dst_port="80"/>
            <filter src_ip="196.248.55.51" dst_ip="134.112.166.196" src_port="49448" dst_port="80"/>
            <filter src_ip="196.248.55.51" dst_ip="134.112.166.196" src_port="49447" dst_port="80"/>
            <filter src_ip="196.248.55.51" dst_ip="134.112.166.196" src_port="49445" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.643520,1.358750,503,1 1 1 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="216.212.114.200" dst_ip="26.30.38.6" dst_port="80"/>
            <filter src_ip="216.212.114.200" dst_ip="197.58.177.93" dst_port="80"/>
            <filter src_ip="217.155.107.29" dst_ip="33.117.131.29" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.260520,1.223030,503,0 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="134.112.166.196" dst_ip="196.248.55.51" src_port="80" dst_port="49451"/>
            <filter src_ip="134.112.166.196" dst_ip="196.248.55.51" src_port="80" dst_port="49448"/>
            <filter src_ip="134.112.166.196" dst_ip="196.248.55.51" src_port="80" dst_port="49447"/>
            <filter src_ip="134.112.166.196" dst_ip="196.248.55.51" src_port="80" dst_port="49445"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.260520,1.223030,503,0 0 0 0 0 0 0 0 0 1 1 1,ptmplaHTTP">
        <slice>
            <filter src_ip="134.99.32.171" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.886579,1.080170,503,1 1 0 0 0 0 0 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="217.155.108.43" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.768713,1.109220,504,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="90.207.51.86" dst_ip="216.219.214.176" src_port="1110" dst_port="443"/>
        </slice>
        <from usec="0" sec="1189314027"/>
        <to usec="0" sec="1189314899"/>
    </anomaly>
    <anomaly type="suspicious" value="0.768713,1.109220,503,1 1 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="168.206.38.142" dst_ip="223.89.67.26" dst_port="80"/>
            <filter src_ip="168.206.38.142" dst_ip="196.248.182.19" dst_port="80"/>
            <filter src_ip="168.206.38.142" dst_ip="33.117.148.193" dst_port="80"/>
        </slice>
        <from usec="0" sec="1189314022"/>
        <to usec="0" sec="1189314028"/>
    </anomaly>
    <anomaly type="suspicious" value="0.768713,1.109220,503,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="203.104.238.146" dst_ip="128.190.13.10" src_port="80" dst_port="1192"/>
        </slice>
        <from usec="0" sec="1189314463"/>
        <to usec="0" sec="1189314469"/>
    </anomaly>
    <anomaly type="suspicious" value="0.768713,1.109220,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="128.190.69.8" dst_ip="194.73.98.80" src_port="80"/>
        </slice>
        <from usec="0" sec="1189314842"/>
        <to usec="0" sec="1189314876"/>
    </anomaly>
    <anomaly type="suspicious" value="1.150110,1.239620,503,1 1 1 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="134.112.226.250" dst_ip="77.69.119.151" src_port="1296" dst_port="80"/>
            <filter src_ip="134.112.226.250" dst_ip="77.69.119.151" src_port="1295" dst_port="80"/>
            <filter src_ip="134.112.226.250" dst_ip="33.117.130.86" src_port="1299" dst_port="80"/>
            <filter src_ip="134.112.226.250" dst_ip="117.40.165.164" src_port="1290" dst_port="80"/>
        </slice>
        <from usec="0" sec="1189314871"/>
        <to usec="0" sec="1189314876"/>
    </anomaly>
    <anomaly type="suspicious" value="1.150110,1.239620,503,1 1 1 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="157.25.78.8" dst_ip="75.97.181.119" src_port="3460" dst_port="80"/>
            <filter src_ip="157.25.78.8" dst_ip="75.97.181.119" src_port="2041" dst_port="80"/>
            <filter src_ip="157.25.78.8" dst_ip="75.97.181.119" src_port="1997" dst_port="80"/>
        </slice>
        <from usec="0" sec="1189314461"/>
        <to usec="0" sec="1189314854"/>
    </anomaly>
    <anomaly type="suspicious" value="0.768713,1.109220,503,1 1 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="134.112.86.4" dst_ip="20.122.176.162" src_port="80" dst_port="57411"/>
            <filter src_ip="134.112.86.4" dst_ip="6.69.81.227" src_port="80" dst_port="1761"/>
            <filter src_ip="134.112.86.4" dst_ip="204.99.7.155" src_port="80" dst_port="49993"/>
        </slice>
        <from usec="0" sec="1189314698"/>
        <to usec="0" sec="1189314704"/>
    </anomaly>
    <anomaly type="suspicious" value="1.150110,1.239620,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="77.27.68.133" dst_port="22"/>
        </slice>
        <from usec="0" sec="1189314293"/>
        <to usec="0" sec="1189314311"/>
    </anomaly>
    <anomaly type="suspicious" value="0.768713,1.109220,503,1 1 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="129.86.144.65" dst_ip="26.211.140.181" dst_port="80"/>
            <filter src_ip="129.86.144.65" dst_ip="26.211.140.201" dst_port="80"/>
        </slice>
        <from usec="0" sec="1189314309"/>
        <to usec="0" sec="1189314856"/>
    </anomaly>
    <anomaly type="suspicious" value="0.763462,1.125350,901,0 1 0 0 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="200.78.217.16" dst_port="53" proto="tcp"/>
        </slice>
        <from usec="0" sec="1189314453"/>
        <to usec="0" sec="1189314521"/>
    </anomaly>
    <anomaly type="suspicious" value="0.763462,1.125350,901,0 1 0 0 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="216.98.212.160" dst_ip="216.98.212.160" proto="udp"/>
        </slice>
        <from usec="0" sec="1189314001"/>
        <to usec="0" sec="1189314899"/>
    </anomaly>
    <anomaly type="suspicious" value="0.768713,1.109220,011,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="77.5.98.0" src_port="5168" dst_port="6000"/>
        </slice>
        <from usec="0" sec="1189314589"/>
        <to usec="0" sec="1189314593"/>
    </anomaly>
    <anomaly type="suspicious" value="0.768713,1.109220,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="26.25.189.122" dst_ip="128.190.125.97" dst_port="80"/>
        </slice>
        <from usec="0" sec="1189314741"/>
        <to usec="0" sec="1189314818"/>
    </anomaly>
    <anomaly type="suspicious" value="1.150110,1.239620,503,1 1 1 0 0 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="157.25.73.230"/>
        </slice>
        <from usec="0" sec="1189314082"/>
        <to usec="0" sec="1189314686"/>
    </anomaly>
    <anomaly type="suspicious" value="0.768713,1.109220,999,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="195.75.159.72" src_port="51419" dst_port="1026"/>
            <filter src_ip="195.75.159.72" src_port="51419" dst_port="1027"/>
        </slice>
        <from usec="0" sec="1189314863"/>
        <to usec="0" sec="1189314868"/>
    </anomaly>
    <anomaly type="suspicious" value="1.150110,1.239620,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="197.11.149.105" src_port="48908" dst_port="1026"/>
        </slice>
        <from usec="0" sec="1189314154"/>
        <to usec="0" sec="1189314157"/>
    </anomaly>
    <anomaly type="suspicious" value="0.768713,1.109220,002,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="196.47.169.18" src_port="57792" dst_port="137"/>
        </slice>
        <from usec="0" sec="1189314238"/>
        <to usec="0" sec="1189314247"/>
    </anomaly>
    <anomaly type="suspicious" value="1.150110,1.239620,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="219.148.59.147" dst_port="139"/>
        </slice>
        <from usec="0" sec="1189314645"/>
        <to usec="0" sec="1189314655"/>
    </anomaly>
    <anomaly type="suspicious" value="0.854557,1.124040,010,1 1 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="33.158.194.100" dst_port="25"/>
        </slice>
        <from usec="0" sec="1189314001"/>
        <to usec="0" sec="1189314901"/>
    </anomaly>
    <anomaly type="suspicious" value="1.150110,1.239620,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="38.202.105.112" dst_port="8000"/>
        </slice>
        <from usec="0" sec="1189314331"/>
        <to usec="0" sec="1189314350"/>
    </anomaly>
    <anomaly type="suspicious" value="1.150110,1.239620,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="77.98.120.248" dst_port="445"/>
        </slice>
        <from usec="0" sec="1189314716"/>
        <to usec="0" sec="1189314782"/>
    </anomaly>
    <anomaly type="suspicious" value="0.768713,1.109220,002,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="77.72.21.115" dst_port="137"/>
        </slice>
        <from usec="0" sec="1189314743"/>
        <to usec="0" sec="1189314755"/>
    </anomaly>
    <anomaly type="suspicious" value="0.970725,1.221680,901,0 0 1 0 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="216.98.212.160" dst_ip="216.98.212.160" proto="udp"/>
        </slice>
        <from usec="0" sec="1189314001"/>
        <to usec="0" sec="1189314889"/>
    </anomaly>
    <anomaly type="suspicious" value="0.753228,1.105490,503,0 0 0 1 0 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="200.78.134.214"/>
        </slice>
        <from usec="0" sec="1189314002"/>
        <to usec="0" sec="1189314197"/>
    </anomaly>
    <anomaly type="suspicious" value="0.753228,1.105490,504,0 0 0 1 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="217.155.107.84"/>
        </slice>
        <from usec="0" sec="1189314003"/>
        <to usec="0" sec="1189314186"/>
    </anomaly>
    <anomaly type="suspicious" value="0.753228,1.105490,503,0 0 0 1 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="161.210.35.175"/>
        </slice>
        <from usec="0" sec="1189314004"/>
        <to usec="0" sec="1189314199"/>
    </anomaly>
    <anomaly type="suspicious" value="0.753228,1.105490,503,0 0 0 1 0 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="203.43.122.177"/>
        </slice>
        <from usec="0" sec="1189314008"/>
        <to usec="0" sec="1189314283"/>
    </anomaly>
    <anomaly type="suspicious" value="0.753228,1.105490,999,0 0 0 1 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="200.78.216.122"/>
        </slice>
        <from usec="0" sec="1189314192"/>
        <to usec="0" sec="1189314262"/>
    </anomaly>
    <anomaly type="suspicious" value="0.753228,1.105490,503,0 0 0 1 0 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="33.117.148.141"/>
        </slice>
        <from usec="0" sec="1189314289"/>
        <to usec="0" sec="1189314333"/>
    </anomaly>
    <anomaly type="suspicious" value="0.753228,1.105490,503,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter dst_ip="22.207.49.53"/>
        </slice>
        <from usec="0" sec="1189314311"/>
        <to usec="0" sec="1189314322"/>
    </anomaly>
    <anomaly type="suspicious" value="0.753228,1.105490,504,0 0 0 1 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="78.231.94.137"/>
        </slice>
        <from usec="0" sec="1189314339"/>
        <to usec="0" sec="1189314487"/>
    </anomaly>
    <anomaly type="suspicious" value="0.753228,1.105490,503,0 0 0 1 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="217.155.105.102"/>
        </slice>
        <from usec="0" sec="1189314024"/>
        <to usec="0" sec="1189314546"/>
    </anomaly>
    <anomaly type="suspicious" value="0.753228,1.105490,503,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="157.25.86.138"/>
        </slice>
        <from usec="0" sec="1189314405"/>
        <to usec="0" sec="1189314507"/>
    </anomaly>
    <anomaly type="suspicious" value="0.845427,1.104150,999,1 0 0 1 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="134.112.2.179" src_port="53"/>
        </slice>
        <from usec="0" sec="1189314002"/>
        <to usec="0" sec="1189314885"/>
    </anomaly>
    <anomaly type="suspicious" value="0.753228,1.105490,999,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter dst_ip="7.128.150.115"/>
        </slice>
        <from usec="0" sec="1189314114"/>
        <to usec="0" sec="1189314739"/>
    </anomaly>
    <anomaly type="suspicious" value="0.753228,1.105490,503,0 0 0 1 0 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="134.168.199.133"/>
        </slice>
        <from usec="0" sec="1189314001"/>
        <to usec="0" sec="1189314828"/>
    </anomaly>
    <anomaly type="suspicious" value="0.753228,1.105490,999,0 0 0 1 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter dst_ip="194.101.169.169"/>
        </slice>
        <from usec="0" sec="1189314001"/>
        <to usec="0" sec="1189314829"/>
    </anomaly>
    <anomaly type="suspicious" value="0.753228,1.105490,999,0 0 0 1 0 0 0 0 0 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="131.130.248.233"/>
        </slice>
        <from usec="0" sec="1189314002"/>
        <to usec="0" sec="1189314826"/>
    </anomaly>
    <anomaly type="suspicious" value="0.753228,1.105490,504,0 0 0 1 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="20.102.177.76"/>
        </slice>
        <from usec="0" sec="1189314004"/>
        <to usec="0" sec="1189314803"/>
    </anomaly>
    <anomaly type="suspicious" value="1.228920,1.240180,999,0 0 0 1 1 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="128.190.173.251" src_port="53"/>
        </slice>
        <from usec="0" sec="1189314004"/>
        <to usec="0" sec="1189314556"/>
    </anomaly>
    <anomaly type="suspicious" value="0.953861,1.074950,999,1 0 0 1 0 0 1 0 0 1 0 0,ntscUDP">
        <slice>
            <filter src_ip="128.190.229.58" src_port="53"/>
            <filter src_ip="128.190.229.58" dst_port="53"/>
            <filter src_ip="134.112.166.137" src_port="53"/>
            <filter src_ip="128.190.229.48" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.840655,1.120350,999,0 0 0 1 0 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="134.131.36.212" src_port="6881"/>
        </slice>
        <from usec="0" sec="1189314034"/>
        <to usec="0" sec="1189314587"/>
    </anomaly>
    <anomaly type="suspicious" value="1.289610,1.311700,999,1 1 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="216.98.208.38" dst_port="53"/>
        </slice>
        <from usec="0" sec="1189314001"/>
        <to usec="0" sec="1189314899"/>
    </anomaly>
    <anomaly type="suspicious" value="1.289610,1.311700,999,1 1 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="216.98.212.174" dst_port="53"/>
        </slice>
        <from usec="0" sec="1189314001"/>
        <to usec="0" sec="1189314899"/>
    </anomaly>
    <anomaly type="suspicious" value="1.136100,1.280770,020,1 0 0 0 0 0 1 1 1 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="20.40.163.107"/>
        </slice>
        <from usec="0" sec="1189314598"/>
        <to usec="0" sec="1189314809"/>
    </anomaly>
    <anomaly type="suspicious" value="1.136100,1.280770,999,1 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="134.112.181.128" dst_port="61364"/>
        </slice>
        <from usec="0" sec="1189314001"/>
        <to usec="0" sec="1189314767"/>
    </anomaly>
    <anomaly type="suspicious" value="1.132550,1.294760,020,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="217.155.106.238"/>
        </slice>
        <from usec="0" sec="1189314001"/>
        <to usec="0" sec="1189314767"/>
    </anomaly>
    <anomaly type="suspicious" value="1.132550,1.294760,010,0 0 0 0 0 0 1 1 1 0 0 0,ptpDoSSYN">
        <slice>
            <filter src_ip="77.77.221.199" dst_ip="203.25.87.81" dst_port="3128"/>
        </slice>
        <from usec="0" sec="1189314001"/>
        <to usec="0" sec="1189314767"/>
    </anomaly>
    <anomaly type="suspicious" value="1.136100,1.280770,010,1 0 0 0 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_ip="20.70.112.136" dst_ip="168.206.244.154"/>
            <filter src_ip="20.70.112.136" dst_ip="168.206.244.155"/>
            <filter src_ip="20.70.112.136" dst_port="3127"/>
            <filter src_ip="20.70.112.136" dst_port="3124"/>
            <filter src_ip="20.70.112.136" dst_port="3128"/>
            <filter dst_ip="168.206.244.154" dst_port="3127"/>
            <filter dst_ip="168.206.244.154" dst_port="3124"/>
            <filter dst_ip="168.206.244.154" dst_port="3128"/>
            <filter dst_ip="168.206.244.155" dst_port="3127"/>
            <filter dst_ip="168.206.244.155" dst_port="3124"/>
            <filter dst_ip="168.206.244.155" dst_port="3128"/>
        </slice>
        <from usec="0" sec="1189314001"/>
        <to usec="0" sec="1189314787"/>
    </anomaly>
    <anomaly type="suspicious" value="1.215640,1.269960,999,0 0 0 0 0 0 1 1 1 1 0 0,mptp">
        <slice>
            <filter dst_ip="168.206.244.152"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.132550,1.294760,010,0 0 0 0 0 0 1 1 1 0 0 0,mptpla">
        <slice>
            <filter src_ip="23.228.137.158" dst_ip="168.206.6.0"/>
            <filter src_ip="6.173.110.92" dst_ip="168.206.6.0"/>
        </slice>
        <from usec="0" sec="1189314001"/>
        <to usec="0" sec="1189314047"/>
    </anomaly>
    <anomaly type="suspicious" value="1.132550,1.294760,020,0 0 0 0 0 0 1 1 1 0 0 0,DDoSIC">
        <slice>
            <filter dst_ip="217.155.108.152"/>
        </slice>
        <from usec="0" sec="1189314001"/>
        <to usec="0" sec="1189314767"/>
    </anomaly>
    <anomaly type="suspicious" value="1.132550,1.294760,010,0 0 0 0 0 0 1 1 1 0 0 0,DDoSSYN">
        <slice>
            <filter dst_ip="53.50.85.2" dst_port="2925"/>
        </slice>
        <from usec="0" sec="1189314001"/>
        <to usec="0" sec="1189314047"/>
    </anomaly>
    <anomaly type="suspicious" value="1.132550,1.294760,004,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="198.208.111.249" src_port="445"/>
        </slice>
        <from usec="0" sec="1189314001"/>
        <to usec="0" sec="1189314047"/>
    </anomaly>
    <anomaly type="suspicious" value="1.132550,1.294760,020,0 0 0 0 0 0 1 1 1 0 0 0,DDoSIC">
        <slice>
            <filter dst_ip="217.155.110.6"/>
        </slice>
        <from usec="0" sec="1189314001"/>
        <to usec="0" sec="1189314767"/>
    </anomaly>
    <anomaly type="suspicious" value="1.132550,1.294760,999,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="216.98.212.160" dst_port="53"/>
        </slice>
        <from usec="0" sec="1189314001"/>
        <to usec="0" sec="1189314767"/>
    </anomaly>
    <anomaly type="suspicious" value="1.132550,1.294760,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="134.112.110.99" dst_port="35801"/>
        </slice>
        <from usec="0" sec="1189314001"/>
        <to usec="0" sec="1189314677"/>
    </anomaly>
    <anomaly type="suspicious" value="1.132550,1.294760,010,0 0 0 0 0 0 1 1 1 0 0 0,DDoSSYN">
        <slice>
            <filter dst_ip="53.50.85.2" dst_port="2925"/>
        </slice>
        <from usec="0" sec="1189314631"/>
        <to usec="0" sec="1189314677"/>
    </anomaly>
    <anomaly type="suspicious" value="1.132550,1.294760,010,0 0 0 0 0 0 1 1 1 0 0 0,DDoSSYN">
        <slice>
            <filter dst_ip="168.206.4.242" dst_port="10339"/>
        </slice>
        <from usec="0" sec="1189314631"/>
        <to usec="0" sec="1189314767"/>
    </anomaly>
    <anomaly type="suspicious" value="1.132550,1.294760,999,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="170.233.181.86" dst_port="13113"/>
        </slice>
        <from usec="0" sec="1189314001"/>
        <to usec="0" sec="1189314767"/>
    </anomaly>
    <anomaly type="suspicious" value="1.136100,1.280770,999,1 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="217.155.105.35" dst_port="53"/>
        </slice>
        <from usec="0" sec="1189314001"/>
        <to usec="0" sec="1189314885"/>
    </anomaly>
    <anomaly type="suspicious" value="1.132550,1.294760,004,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="198.208.111.249" src_port="445"/>
        </slice>
        <from usec="0" sec="1189314631"/>
        <to usec="0" sec="1189314677"/>
    </anomaly>
    <anomaly type="suspicious" value="1.289610,1.311700,020,1 1 0 0 0 0 1 1 1 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="33.158.194.100"/>
        </slice>
        <from usec="0" sec="1189314001"/>
        <to usec="0" sec="1189314896"/>
    </anomaly>
    <anomaly type="suspicious" value="1.132550,1.294760,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="216.212.184.91" dst_port="15621"/>
        </slice>
        <from usec="0" sec="1189314001"/>
        <to usec="0" sec="1189314767"/>
    </anomaly>
    <anomaly type="suspicious" value="1.136100,1.280770,010,1 0 0 0 0 0 1 1 1 0 0 0,DDoSSYN">
        <slice>
            <filter dst_ip="216.212.114.51" dst_port="28192"/>
        </slice>
        <from usec="0" sec="1189314001"/>
        <to usec="0" sec="1189314767"/>
    </anomaly>
    <anomaly type="suspicious" value="1.132550,1.294760,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="208.194.233.50" dst_port="53"/>
        </slice>
        <from usec="0" sec="1189314001"/>
        <to usec="0" sec="1189314767"/>
    </anomaly>
    <anomaly type="suspicious" value="1.136100,1.280770,999,1 0 0 0 0 0 1 1 1 0 0 0,mptpla">
        <slice>
            <filter src_ip="217.217.102.89" dst_ip="217.155.109.52" dst_port="53"/>
            <filter src_ip="217.217.102.90" dst_ip="217.155.109.52" dst_port="53"/>
            <filter src_ip="217.217.102.88" dst_ip="217.155.109.52" dst_port="53"/>
            <filter src_ip="217.217.102.92" dst_ip="217.155.109.52" dst_port="53"/>
        </slice>
        <from usec="0" sec="1189314001"/>
        <to usec="0" sec="1189314677"/>
    </anomaly>
    <anomaly type="suspicious" value="1.132550,1.294760,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="217.155.109.37" dst_port="53"/>
        </slice>
        <from usec="0" sec="1189314001"/>
        <to usec="0" sec="1189314767"/>
    </anomaly>
    <anomaly type="suspicious" value="1.132550,1.294760,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="134.112.166.137" dst_port="53"/>
            <filter dst_ip="134.112.166.137" src_port="53" dst_port="40769"/>
        </slice>
        <from usec="0" sec="1189314001"/>
        <to usec="0" sec="1189314767"/>
    </anomaly>
    <anomaly type="suspicious" value="1.132550,1.294760,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="128.190.229.48" dst_port="53"/>
            <filter dst_ip="128.190.229.48" src_port="53" dst_port="65486"/>
        </slice>
        <from usec="0" sec="1189314001"/>
        <to usec="0" sec="1189314767"/>
    </anomaly>
    <anomaly type="suspicious" value="1.132550,1.294760,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="134.112.2.141" dst_port="53"/>
        </slice>
        <from usec="0" sec="1189314001"/>
        <to usec="0" sec="1189314767"/>
    </anomaly>
    <anomaly type="suspicious" value="0.768713,1.109220,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="216.219.229.198" dst_ip="222.43.241.13" dst_port="80"/>
        </slice>
        <from usec="0" sec="1189314001"/>
        <to usec="0" sec="1189314899"/>
    </anomaly>
    <anomaly type="suspicious" value="0.873187,1.076330,503,0 0 0 1 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="134.112.166.14" dst_ip="22.76.5.152" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.877782,1.059450,503,1 0 0 1 0 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="128.190.125.103" src_port="80"/>
            <filter src_ip="128.190.81.98" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.880018,1.080900,503,0 0 0 0 0 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter src_ip="20.42.232.80" dst_ip="134.112.22.206" src_port="80"/>
            <filter src_ip="117.37.216.23" dst_ip="134.112.22.206" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.873187,1.076330,503,0 0 0 1 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="222.43.241.13" dst_ip="216.219.229.198" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.884578,1.064100,503,1 0 0 0 0 0 0 0 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="216.212.118.33" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.215640,1.269960,999,0 0 0 0 0 0 1 1 1 1 0 0,alphfl">
        <slice>
            <filter src_ip="134.112.2.179" dst_ip="23.115.123.124" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.880018,1.080900,503,0 0 0 0 0 0 0 0 0 1 1 0,salphfl">
        <slice>
            <filter src_ip="33.117.148.205" dst_ip="134.131.36.229" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.880018,1.080900,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="33.117.130.72" dst_ip="134.112.226.250" src_port="80" dst_port="1244"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.880018,1.080900,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="128.190.104.26" dst_ip="77.150.50.33" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.880018,1.080900,999,0 0 0 0 0 0 0 0 0 1 1 0,ptmpla">
        <slice>
            <filter src_ip="157.25.187.76" src_port="13322"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.880018,1.080900,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="134.112.226.250" dst_ip="33.117.130.72" src_port="1244" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.880018,1.080900,999,0 0 0 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="128.190.20.182" src_port="25"/>
            <filter dst_ip="128.190.20.182" dst_port="25"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.880018,1.080900,503,0 0 0 0 0 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter dst_ip="134.112.76.32" dst_port="17482"/>
            <filter src_ip="24.36.40.141" dst_ip="134.112.76.32" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.880018,1.080900,503,0 0 0 0 0 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter src_ip="168.206.244.244" dst_ip="145.43.146.37" src_port="80"/>
            <filter src_ip="134.99.32.142" dst_ip="145.43.146.37" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.880018,1.080900,503,0 0 0 0 0 0 0 0 0 1 1 0,salphfl">
        <slice>
            <filter src_ip="200.78.134.123" dst_ip="168.206.6.220" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.880018,1.080900,503,0 0 0 0 0 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter src_ip="217.155.96.82" dst_ip="174.5.13.24" src_port="80" dst_port="64626"/>
            <filter src_ip="217.155.107.13" dst_ip="174.5.13.24" src_port="80" dst_port="3523"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.880018,1.080900,503,0 0 0 0 0 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter dst_ip="216.212.118.33" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.880018,1.080900,503,0 0 0 0 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="216.219.192.26" src_port="80"/>
            <filter dst_ip="216.219.192.26" src_port="53" dst_port="64785"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.067400,1.080820,503,1 0 0 1 0 0 0 0 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="217.155.108.43" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.880018,1.080900,999,0 0 0 0 0 0 0 0 0 1 1 0,mptpla">
        <slice>
            <filter src_ip="134.112.166.138" dst_ip="194.101.155.238" src_port="995" dst_port="8301"/>
            <filter src_ip="134.112.166.138" dst_ip="194.101.155.238" src_port="995" dst_port="6924"/>
            <filter src_ip="128.190.76.202" dst_ip="194.101.155.238" src_port="2492" dst_port="6937"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.880018,1.080900,999,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="157.25.242.47" dst_ip="195.216.135.82" src_port="995" dst_port="33047"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.880018,1.080900,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="128.190.80.128" dst_ip="76.133.95.91" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.880018,1.080900,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="170.233.69.151" dst_ip="22.76.5.27" src_port="80" dst_port="61056"/>
            <filter src_ip="170.233.69.151" dst_ip="22.76.5.27" src_port="80" dst_port="4404"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
