<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="anomalous" value="2.064840,1.616770,999,1 1 1 1 0 0 0 0 0 1 1 1,empty">
        <slice>
            <filter src_ip="220.217.250.176" dst_ip="172.133.130.9"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.281640,1.795840,503,1 1 1 1 1 1 0 0 0 1 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="169.6.82.25" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.550550,1.537730,503,1 1 1 0 0 0 0 0 0 1 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="71.58.185.228" dst_ip="169.6.160.193" dst_port="80"/>
            <filter src_ip="52.179.109.24" dst_ip="169.6.160.193" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.740750,1.548380,503,1 1 1 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="201.66.228.107" dst_ip="169.6.177.130" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.739540,1.373850,503,1 1 0 1 0 0 1 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="172.159.73.96" dst_port="80"/>
            <filter src_ip="172.130.41.13" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.679440,1.580230,999,1 1 0 1 0 0 1 1 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="172.159.81.233" src_port="61364"/>
        </slice>
        <from usec="0" sec="1191992403"/>
        <to usec="0" sec="1191993046"/>
    </anomaly>
    <anomaly type="anomalous" value="1.457860,1.326530,503,1 1 0 1 1 0 1 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="200.173.77.250" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.834800,1.577640,503,1 0 0 1 1 1 0 0 0 1 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="134.71.143.139" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.834800,1.577640,503,1 0 0 1 1 1 0 0 0 1 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="200.173.77.250" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.724740,1.643430,503,0 0 0 1 1 1 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="217.82.167.48" dst_ip="172.159.209.238" src_port="80"/>
        </slice>
        <from usec="0" sec="1191992727"/>
        <to usec="0" sec="1191992762"/>
    </anomaly>
    <anomaly type="anomalous" value="1.724740,1.643430,999,0 0 0 1 1 1 0 0 0 0 0 0,point_to_point">
        <slice>
            <filter src_ip="169.6.246.190" dst_ip="84.72.230.210" dst_port="25"/>
        </slice>
        <from usec="0" sec="1191992406"/>
        <to usec="0" sec="1191992910"/>
    </anomaly>
    <anomaly type="anomalous" value="1.724740,1.643430,999,0 0 0 1 1 1 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="134.71.66.179" dst_ip="5.79.217.165" src_port="8319" dst_port="2341"/>
            <filter src_ip="134.71.66.179" dst_ip="5.79.217.165" src_port="1899" dst_port="2295"/>
            <filter src_ip="134.71.66.179" dst_ip="5.79.217.165" src_port="1817" dst_port="2295"/>
            <filter src_ip="134.71.66.179" dst_ip="5.79.217.165" src_port="1730" dst_port="2295"/>
        </slice>
        <from usec="0" sec="1191992903"/>
        <to usec="0" sec="1191993046"/>
    </anomaly>
    <anomaly type="anomalous" value="1.338470,1.320120,503,1 0 0 1 1 0 1 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="134.71.143.139" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.473560,2.179980,999,0 0 0 1 0 0 1 1 1 0 0 0,ntscACK">
        <slice>
            <filter src_ip="201.67.2.127"/>
        </slice>
        <from usec="0" sec="1191992401"/>
        <to usec="0" sec="1191993212"/>
    </anomaly>
    <anomaly type="anomalous" value="2.889570,2.297060,999,1 1 1 1 0 0 1 1 1 1 0 0,ptmp">
        <slice>
            <filter src_ip="200.173.78.144"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.372750,1.256240,503,1 1 0 1 0 0 1 0 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="169.6.90.4" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.811250,2.338930,010,1 1 1 0 0 0 1 1 1 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="136.132.145.103" dst_port="2967"/>
        </slice>
        <from usec="0" sec="1191992402"/>
        <to usec="0" sec="1191993300"/>
    </anomaly>
    <anomaly type="anomalous" value="2.454930,2.201180,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="169.6.74.135" src_port="30903"/>
        </slice>
        <from usec="0" sec="1191992536"/>
        <to usec="0" sec="1191992762"/>
    </anomaly>
    <anomaly type="anomalous" value="2.454930,2.201180,503,0 0 0 0 0 0 1 1 1 0 0 0,ntscACK">
        <slice>
            <filter src_ip="172.130.76.153" dst_port="80"/>
            <filter src_ip="172.130.76.153" src_port="1121" dst_port="9910"/>
            <filter src_ip="172.130.76.153" src_port="1122" dst_port="9910"/>
            <filter src_ip="172.130.76.153" src_port="1120" dst_port="9910"/>
        </slice>
        <from usec="0" sec="1191992536"/>
        <to usec="0" sec="1191992582"/>
    </anomaly>
    <anomaly type="anomalous" value="2.010520,1.615650,999,1 1 0 1 1 0 1 1 0 1 0 0,ntscUDP">
        <slice>
            <filter src_ip="201.67.1.25" src_port="4291" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.581490,2.563580,010,1 1 1 1 1 1 1 1 1 1 1 1,ptmp">
        <slice>
            <filter src_ip="85.197.81.206" dst_port="135"/>
            <filter src_ip="85.197.81.206"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.581490,2.563580,010,1 1 1 1 1 1 1 1 1 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="81.89.100.21" src_port="6000" dst_port="135"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.690990,1.886760,503,1 1 1 1 1 1 1 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_port="80"/>
            <filter dst_ip="85.197.81.206"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.453460,1.376090,503,0 0 0 1 1 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter src_ip="172.130.202.48" dst_ip="81.208.173.73" src_port="80"/>
            <filter src_ip="172.130.202.61" dst_ip="81.208.173.73" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.163520,1.764950,999,1 1 1 1 0 0 1 1 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="134.71.143.213" dst_port="33457"/>
            <filter src_ip="134.71.143.213"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.545050,1.410160,503,0 0 0 1 0 0 0 0 0 1 1 1,mptplaHTTP">
        <slice>
            <filter src_ip="200.225.100.23" dst_ip="169.6.98.2" src_port="80"/>
            <filter src_ip="200.225.100.15" dst_ip="169.6.98.2" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.265840,1.682600,503,1 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="201.67.0.11" src_port="80"/>
            <filter dst_ip="201.75.52.254" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.527210,1.403820,503,1 0 0 0 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="1.178.159.28" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.362860,1.329300,503,1 1 0 1 1 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="169.6.148.220" dst_port="80"/>
            <filter dst_ip="205.18.189.89" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.527210,1.403820,503,1 0 0 0 0 0 0 0 0 1 1 1,mptplaHTTP">
        <slice>
            <filter src_ip="169.6.237.185" dst_ip="1.178.133.18" src_port="64084" dst_port="80"/>
            <filter src_ip="134.71.214.12" dst_ip="1.178.133.18" src_port="2060" dst_port="80"/>
            <filter src_ip="188.104.67.104" dst_ip="1.178.133.18" src_port="2447" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.257660,1.715180,503,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="201.66.166.237" dst_ip="169.6.237.185"/>
            <filter src_ip="201.66.166.237" dst_ip="134.71.214.12"/>
            <filter src_ip="201.66.166.237" src_port="80"/>
            <filter dst_ip="169.6.237.185" src_port="80"/>
            <filter dst_ip="134.71.214.12" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.671380,2.138520,999,1 0 0 1 0 0 1 1 1 1 1 0,mptmp">
        <slice>
            <filter dst_ip="201.136.121.209" dst_port="53"/>
            <filter dst_ip="201.136.124.141" dst_port="53"/>
            <filter dst_ip="201.136.122.110" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.949690,1.558460,999,1 1 0 1 0 0 1 1 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="200.173.78.144"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.338360,1.687630,503,1 1 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="201.67.0.11" dst_port="80"/>
            <filter src_ip="201.75.52.254" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.556970,1.370350,503,1 0 0 1 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="169.6.217.81" src_port="80"/>
            <filter dst_ip="201.75.50.157" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.690990,1.886760,503,1 1 1 1 1 1 1 0 0 1 1 1,mptmp">
        <slice>
            <filter src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.515050,1.442710,503,0 0 0 0 0 0 0 0 0 1 1 1,ptmplaHTTP">
        <slice>
            <filter src_ip="169.6.177.130" dst_ip="201.66.228.107" src_port="80"/>
            <filter src_ip="169.6.177.130" dst_ip="49.211.91.105" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.338900,1.292680,503,1 1 0 0 0 0 1 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="169.6.240.43" dst_port="80"/>
            <filter src_ip="172.130.129.165" dst_ip="209.50.43.74" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.973050,1.449780,503,1 1 0 1 1 0 1 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="169.6.84.37" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.632860,1.409850,503,1 1 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="169.6.173.45" dst_port="80"/>
            <filter dst_ip="42.165.103.78" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.739540,1.373850,503,1 1 0 1 0 0 1 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="172.130.96.216" dst_port="80"/>
            <filter src_ip="201.75.50.157" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.739540,1.373850,503,1 1 0 1 0 0 1 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="169.6.65.165" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.257660,1.715180,503,0 0 0 1 1 1 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="169.6.221.166" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.265840,1.682600,503,1 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_port="80"/>
            <filter dst_ip="172.159.80.74" dst_port="26679"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.766360,1.921300,503,1 1 0 1 1 1 1 1 0 1 1 1,ntscACK">
        <slice>
            <filter src_ip="172.159.80.74" src_port="26679"/>
            <filter src_ip="201.75.50.32" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.545050,1.410160,503,0 0 0 1 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="81.33.118.230" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.739540,1.373850,503,1 1 0 1 0 0 1 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="169.6.104.249" dst_port="80"/>
            <filter dst_ip="1.178.132.193" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.314770,2.415760,020,1 0 0 1 1 1 1 1 1 1 1 1,ntscICec">
        <slice>
            <filter src_ip="222.25.128.216"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.515050,1.442710,503,0 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="209.50.43.74" dst_ip="169.6.246.12" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.515050,1.442710,503,0 0 0 0 0 0 0 0 0 1 1 1,salphfl">
        <slice>
            <filter src_ip="194.217.44.70" dst_ip="169.6.148.220" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.690990,1.886760,503,1 1 1 1 1 1 1 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="172.133.82.182" src_port="80"/>
            <filter dst_ip="172.133.82.180" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.658730,1.338860,503,1 1 0 1 1 0 1 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="180.49.137.74" dst_ip="84.15.216.4" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.545050,1.410160,503,0 0 0 1 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="1.178.159.144" src_port="80"/>
            <filter dst_ip="172.96.25.197" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.324220,1.680410,503,1 0 0 1 1 1 1 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="201.180.44.206"/>
            <filter src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.545050,1.410160,503,0 0 0 1 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="134.71.61.8" src_port="80"/>
            <filter dst_ip="134.71.200.114" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.581490,2.563580,010,1 1 1 1 1 1 1 1 1 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="81.12.128.7" dst_port="1080"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.545050,1.410160,503,0 0 0 1 0 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="172.159.72.86" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.431590,1.570300,503,1 1 1 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="1.178.159.118" dst_ip="134.71.84.4" src_port="80" dst_port="1039"/>
        </slice>
        <from usec="0" sec="1191992586"/>
        <to usec="0" sec="1191992618"/>
    </anomaly>
    <anomaly type="suspicious" value="0.901050,1.318850,503,1 1 0 0 0 0 1 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="169.6.66.185" dst_ip="201.66.109.170" dst_port="80"/>
        </slice>
        <from usec="0" sec="1191993166"/>
        <to usec="0" sec="1191993212"/>
    </anomaly>
    <anomaly type="suspicious" value="1.080110,1.279900,503,1 1 0 0 0 0 1 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="200.173.64.95" dst_port="80"/>
            <filter src_ip="84.15.125.132" dst_ip="200.173.64.95" dst_port="21"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.950622,1.283160,999,1 1 0 1 0 0 1 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="172.159.83.107" dst_port="25"/>
            <filter dst_ip="52.58.130.30" dst_port="25"/>
        </slice>
        <from usec="0" sec="1191992401"/>
        <to usec="0" sec="1191993049"/>
    </anomaly>
    <anomaly type="suspicious" value="1.431590,1.570300,503,1 1 1 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="188.104.51.130" dst_port="80"/>
        </slice>
        <from usec="0" sec="1191993174"/>
        <to usec="0" sec="1191993177"/>
    </anomaly>
    <anomaly type="suspicious" value="1.431590,1.570300,020,1 1 1 0 0 0 0 0 0 0 0 0,icmp_error">
        <slice>
            <filter src_ip="200.173.65.11"/>
        </slice>
        <from usec="0" sec="1191992738"/>
        <to usec="0" sec="1191992743"/>
    </anomaly>
    <anomaly type="suspicious" value="1.431590,1.570300,503,1 1 1 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="62.144.145.232" dst_ip="134.71.20.71" src_port="80" dst_port="47225"/>
        </slice>
        <from usec="0" sec="1191992582"/>
        <to usec="0" sec="1191992685"/>
    </anomaly>
    <anomaly type="suspicious" value="1.431590,1.570300,011,1 1 1 0 0 0 0 0 0 0 0 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="81.89.100.21" src_port="135" dst_port="6000"/>
        </slice>
        <from usec="0" sec="1191992740"/>
        <to usec="0" sec="1191992762"/>
    </anomaly>
    <anomaly type="suspicious" value="1.080110,1.279900,503,1 1 0 0 0 0 1 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="169.6.15.101" dst_ip="209.50.2.130" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.431590,1.570300,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="220.1.33.71" src_port="43252" dst_port="1027"/>
            <filter src_ip="220.1.33.71" src_port="43252" dst_port="1026"/>
        </slice>
        <from usec="0" sec="1191992699"/>
        <to usec="0" sec="1191992702"/>
    </anomaly>
    <anomaly type="suspicious" value="1.431590,1.570300,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="220.0.200.193" src_port="39869"/>
            <filter src_ip="220.0.200.193" src_port="39871"/>
            <filter src_port="39869" dst_port="1026"/>
            <filter src_port="39869" dst_port="1027"/>
            <filter src_port="39871" dst_port="1026"/>
            <filter src_port="39871" dst_port="1027"/>
            <filter src_ip="220.0.200.193" src_port="40679" dst_port="1026"/>
            <filter src_ip="220.0.200.193" src_port="40679" dst_port="1027"/>
        </slice>
        <from usec="0" sec="1191992874"/>
        <to usec="0" sec="1191993004"/>
    </anomaly>
    <anomaly type="suspicious" value="1.431590,1.570300,001,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNtSAbado">
        <slice>
            <filter src_ip="0.205.52.57" dst_port="9898"/>
        </slice>
        <from usec="0" sec="1191992534"/>
        <to usec="0" sec="1191992536"/>
    </anomaly>
    <anomaly type="suspicious" value="0.901050,1.318850,010,1 1 0 0 0 0 1 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="221.40.214.11" dst_port="139"/>
            <filter src_ip="221.40.214.11" dst_port="445"/>
        </slice>
        <from usec="0" sec="1191992711"/>
        <to usec="0" sec="1191992762"/>
    </anomaly>
    <anomaly type="suspicious" value="0.947981,1.282770,503,1 1 0 0 0 0 0 0 0 1 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="169.6.31.186" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.295610,1.599870,901,0 0 1 0 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="136.132.145.103" dst_ip="136.132.145.103" proto="icmp"/>
        </slice>
        <from usec="0" sec="1191992401"/>
        <to usec="0" sec="1191993300"/>
    </anomaly>
    <anomaly type="suspicious" value="1.295610,1.599870,901,0 0 1 0 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="134.71.20.71" dst_ip="134.71.20.71" src_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1191992591"/>
        <to usec="0" sec="1191993116"/>
    </anomaly>
    <anomaly type="suspicious" value="1.132520,1.252410,503,1 0 0 1 0 0 0 0 0 1 1 0,ptmplaHTTP">
        <slice>
            <filter src_ip="172.130.202.2" dst_ip="61.86.169.48" src_port="80"/>
            <filter src_ip="172.130.202.2" dst_ip="81.50.9.119" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.063850,1.400710,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="209.50.2.33" dst_ip="169.6.96.192" src_port="80"/>
        </slice>
        <from usec="0" sec="1191992449"/>
        <to usec="0" sec="1191992590"/>
    </anomaly>
    <anomaly type="suspicious" value="1.063850,1.400710,503,0 0 0 1 1 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="201.67.35.223" dst_ip="62.144.103.117" dst_port="80"/>
            <filter src_ip="169.6.115.64" dst_ip="62.144.103.117" dst_port="80"/>
        </slice>
        <from usec="0" sec="1191992433"/>
        <to usec="0" sec="1191992572"/>
    </anomaly>
    <anomaly type="suspicious" value="1.063850,1.400710,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="134.71.64.109" dst_ip="219.190.224.91" dst_port="80"/>
        </slice>
        <from usec="0" sec="1191992439"/>
        <to usec="0" sec="1191992457"/>
    </anomaly>
    <anomaly type="suspicious" value="1.063850,1.400710,504,0 0 0 1 1 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="172.159.121.156" dst_ip="32.156.110.133" dst_port="443"/>
            <filter src_ip="188.104.72.159" dst_ip="32.156.110.133" dst_port="443"/>
        </slice>
        <from usec="0" sec="1191992442"/>
        <to usec="0" sec="1191992581"/>
    </anomaly>
    <anomaly type="suspicious" value="1.063850,1.400710,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="188.104.31.116" dst_ip="201.61.225.42" dst_port="80"/>
        </slice>
        <from usec="0" sec="1191992406"/>
        <to usec="0" sec="1191993047"/>
    </anomaly>
    <anomaly type="suspicious" value="1.063850,1.400710,503,0 0 0 1 1 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="169.6.100.97" dst_ip="208.24.45.65" src_port="1327" dst_port="80"/>
        </slice>
        <from usec="0" sec="1191992837"/>
        <to usec="0" sec="1191992964"/>
    </anomaly>
    <anomaly type="suspicious" value="1.063850,1.400710,503,0 0 0 1 1 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="169.6.221.166" dst_ip="80.72.63.99" src_port="38840" dst_port="80"/>
        </slice>
        <from usec="0" sec="1191992403"/>
        <to usec="0" sec="1191992959"/>
    </anomaly>
    <anomaly type="suspicious" value="1.063850,1.400710,503,0 0 0 1 1 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="172.130.196.206" dst_ip="210.128.115.180" dst_port="80"/>
            <filter src_ip="188.104.92.98" dst_ip="210.128.115.180" dst_port="80"/>
        </slice>
        <from usec="0" sec="1191992409"/>
        <to usec="0" sec="1191993020"/>
    </anomaly>
    <anomaly type="suspicious" value="1.019800,1.433480,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1191992401"/>
        <to usec="0" sec="1191993229"/>
    </anomaly>
    <anomaly type="suspicious" value="1.063850,1.400710,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="134.71.40.204" dst_ip="61.185.205.160" dst_port="80"/>
        </slice>
        <from usec="0" sec="1191992718"/>
        <to usec="0" sec="1191993035"/>
    </anomaly>
    <anomaly type="suspicious" value="1.063850,1.400710,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="188.104.31.99" dst_ip="200.162.236.156" dst_port="80"/>
        </slice>
        <from usec="0" sec="1191992991"/>
        <to usec="0" sec="1191993137"/>
    </anomaly>
    <anomaly type="suspicious" value="1.063850,1.400710,010,0 0 0 1 1 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="172.87.43.95" dst_port="4662"/>
        </slice>
        <from usec="0" sec="1191992413"/>
        <to usec="0" sec="1191993223"/>
    </anomaly>
    <anomaly type="suspicious" value="1.547540,1.604070,020,1 0 0 0 0 0 1 1 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="203.132.179.56"/>
        </slice>
        <from usec="0" sec="1191992401"/>
        <to usec="0" sec="1191992483"/>
    </anomaly>
    <anomaly type="suspicious" value="1.330640,1.364140,999,1 1 0 1 1 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="172.96.25.244" src_port="6881"/>
        </slice>
        <from usec="0" sec="1191992401"/>
        <to usec="0" sec="1191993139"/>
    </anomaly>
    <anomaly type="suspicious" value="1.230280,1.293010,999,0 0 0 1 0 0 1 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="169.6.2.243" src_port="24457"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.183110,1.398080,503,0 0 0 1 1 0 1 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="201.75.182.182" dst_port="80"/>
        </slice>
        <from usec="0" sec="1191992401"/>
        <to usec="0" sec="1191993139"/>
    </anomaly>
    <anomaly type="suspicious" value="1.565140,1.609620,999,0 0 0 1 0 0 1 1 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="172.159.81.158" src_port="14918"/>
        </slice>
        <from usec="0" sec="1191992451"/>
        <to usec="0" sec="1191992957"/>
    </anomaly>
    <anomaly type="suspicious" value="0.942106,1.280240,999,0 0 0 1 0 0 1 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="172.159.168.251" dst_port="53"/>
            <filter dst_ip="192.162.29.68" dst_port="53"/>
            <filter dst_ip="192.132.33.207" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.522310,1.567960,503,1 1 1 0 0 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="200.210.20.255" dst_port="80"/>
        </slice>
        <from usec="0" sec="1191992603"/>
        <to usec="0" sec="1191992832"/>
    </anomaly>
    <anomaly type="suspicious" value="1.535540,1.638210,011,0 0 0 0 0 0 1 1 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="60.20.75.171" src_port="22" dst_port="3072"/>
            <filter src_ip="60.20.75.171" src_port="22" dst_port="1024"/>
        </slice>
        <from usec="0" sec="1191992536"/>
        <to usec="0" sec="1191992762"/>
    </anomaly>
    <anomaly type="suspicious" value="1.535540,1.638210,020,0 0 0 0 0 0 1 1 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="203.245.109.100"/>
        </slice>
        <from usec="0" sec="1191992536"/>
        <to usec="0" sec="1191992582"/>
    </anomaly>
    <anomaly type="suspicious" value="1.091250,1.288950,503,1 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="169.6.82.16" dst_ip="217.147.163.194" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.116070,1.295850,503,0 0 0 1 0 0 0 0 0 1 1 0,malphfl">
        <slice>
            <filter src_ip="134.71.121.129" dst_ip="62.227.220.8" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.892061,1.316010,999,0 0 0 0 0 0 1 0 0 1 0 0,ntscUDP">
        <slice>
            <filter src_ip="85.60.176.25" src_port="1085" dst_port="1434"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.116070,1.295850,503,0 0 0 1 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="201.75.50.168" dst_ip="4.121.188.29" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.245220,1.249470,503,1 0 0 1 0 0 1 0 0 1 1 0,mptmp">
        <slice>
            <filter dst_ip="201.67.2.127" dst_port="16186"/>
            <filter dst_ip="172.159.122.44" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.091250,1.288950,999,1 0 0 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="201.67.35.153" src_port="25"/>
            <filter dst_ip="201.67.35.153" dst_port="25"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.074160,1.331200,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="169.6.160.193" dst_ip="71.58.185.228" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.074160,1.331200,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="168.53.144.200" dst_ip="71.58.176.200" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.132520,1.252410,503,1 0 0 1 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="1.178.132.182" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.074160,1.331200,503,0 0 0 0 0 0 0 0 0 1 1 0,salphfl">
        <slice>
            <filter src_ip="134.71.61.8" dst_ip="1.178.159.50" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.074160,1.331200,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="212.151.53.164" dst_ip="201.67.2.124" src_port="80" dst_port="46971"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.074160,1.331200,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="169.6.217.24" dst_ip="81.20.122.156" src_port="1232" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.074160,1.331200,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="169.6.217.24" dst_ip="81.20.122.133" src_port="2194" dst_port="80"/>
            <filter src_ip="169.6.217.24" dst_ip="81.20.122.133" src_port="1577" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.074160,1.331200,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="169.6.217.24" dst_ip="81.20.122.135" src_port="1647" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.074160,1.331200,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="169.6.217.24" dst_ip="81.20.122.146" src_port="4923" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.234780,1.295520,503,1 1 0 0 0 0 0 0 0 1 1 0,ptmplaHTTP">
        <slice>
            <filter src_ip="172.159.125.38" dst_ip="52.58.128.45" dst_port="80"/>
            <filter src_ip="172.159.125.38" dst_ip="208.24.44.177" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
