<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="anomalous" value="2.325720,1.828440,010,1 1 1 1 0 0 1 1 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="218.173.88.22" src_port="6000" dst_port="135"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.045630,1.597990,503,1 1 1 0 0 0 0 0 0 1 1 1,ptmplaHTTP">
        <slice>
            <filter src_ip="129.60.132.74" dst_ip="2.122.208.202" src_port="49766" dst_port="80"/>
            <filter src_ip="129.60.132.74" dst_ip="2.122.208.202" src_port="49765" dst_port="80"/>
            <filter src_ip="129.60.132.74" dst_ip="2.122.209.42" src_port="49761" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.622810,1.538730,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="221.28.16.172" src_port="35111" dst_port="1026"/>
            <filter src_ip="221.28.16.172" src_port="35111" dst_port="1027"/>
            <filter src_ip="221.28.16.172" src_port="34072" dst_port="1026"/>
            <filter src_ip="221.28.16.172" src_port="34072" dst_port="1027"/>
        </slice>
        <from usec="0" sec="1194757587"/>
        <to usec="0" sec="1194757770"/>
    </anomaly>
    <anomaly type="anomalous" value="1.622810,1.538730,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="34.14.64.100" src_port="12200" dst_port="8080"/>
            <filter src_ip="34.14.64.100" src_port="12200" dst_port="8000"/>
            <filter src_ip="34.14.64.100" src_port="12200" dst_port="3128"/>
            <filter src_ip="34.14.64.100" src_port="12200" dst_port="3127"/>
            <filter src_ip="34.14.64.100" src_port="12200" dst_port="80"/>
        </slice>
        <from usec="0" sec="1194757742"/>
        <to usec="0" sec="1194757748"/>
    </anomaly>
    <anomaly type="anomalous" value="2.330240,1.846640,010,1 1 1 0 0 0 1 1 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="222.98.74.141" src_port="6000" dst_port="3128"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.622810,1.538730,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="192.239.129.57" src_port="45583" dst_port="1027"/>
            <filter src_ip="192.239.129.57" src_port="45583" dst_port="1026"/>
        </slice>
        <from usec="0" sec="1194757747"/>
        <to usec="0" sec="1194757752"/>
    </anomaly>
    <anomaly type="anomalous" value="1.622810,1.538730,999,1 1 1 0 0 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="152.174.217.78"/>
        </slice>
        <from usec="0" sec="1194757486"/>
        <to usec="0" sec="1194758091"/>
    </anomaly>
    <anomaly type="anomalous" value="2.088120,1.545130,503,1 0 0 1 1 1 1 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="144.45.54.134" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.616300,1.516830,501,1 1 1 1 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="192.30.83.255" dst_ip="57.46.180.217" dst_port="21"/>
        </slice>
        <from usec="0" sec="1194757201"/>
        <to usec="0" sec="1194758097"/>
    </anomaly>
    <anomaly type="anomalous" value="1.328660,1.109410,503,1 0 0 1 1 0 0 0 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="173.144.137.29" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.964150,1.776880,020,1 1 1 1 0 0 1 1 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="193.1.194.93"/>
        </slice>
        <from usec="0" sec="1194757201"/>
        <to usec="0" sec="1194758008"/>
    </anomaly>
    <anomaly type="anomalous" value="1.969980,1.483220,503,0 0 0 1 1 1 0 0 0 1 1 1,mptplaHTTP">
        <slice>
            <filter src_ip="193.87.222.9" dst_ip="129.60.132.74" src_port="80"/>
            <filter src_ip="193.87.222.10" dst_ip="129.60.132.74" src_port="80"/>
            <filter src_ip="2.122.208.202" dst_ip="129.60.132.74" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.557110,1.225070,502,1 1 0 1 1 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="220.218.173.248" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.272970,1.107990,501,0 0 0 1 1 0 0 0 0 1 1 0,ptmpla">
        <slice>
            <filter src_ip="193.1.205.47" dst_ip="89.41.208.179"/>
            <filter src_ip="193.1.205.47" src_port="21"/>
            <filter dst_ip="89.41.208.179" src_port="21"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.969980,1.483220,503,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="129.33.160.216" dst_ip="222.72.10.112" src_port="80"/>
            <filter src_ip="129.33.160.216" dst_ip="5.194.61.161" src_port="80"/>
            <filter src_ip="129.33.160.210" dst_ip="222.72.10.112" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.969980,1.483220,501,0 0 0 1 1 1 0 0 0 1 1 1,mptpla">
        <slice>
            <filter src_ip="152.174.153.187" dst_ip="48.164.142.76" src_port="21"/>
            <filter src_ip="129.33.55.172" dst_ip="48.164.142.76" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.969980,1.483220,999,0 0 0 1 1 1 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="192.188.121.23" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.741410,1.404440,503,0 0 0 1 1 1 0 0 0 1 1 0,salphfl">
        <slice>
            <filter src_ip="4.242.29.0" dst_ip="129.37.80.57" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.969980,1.483220,503,0 0 0 1 1 1 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="129.33.160.239" dst_ip="4.131.241.174" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.612880,1.402580,503,0 0 0 1 1 1 0 0 0 1 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="2.122.208.202" dst_ip="129.60.209.151" src_port="80"/>
            <filter src_ip="2.122.208.244" dst_ip="129.60.209.151" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.288560,1.703300,901,1 1 1 1 1 0 1 0 0 1 1 1,empty">
        <slice/>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.144140,1.840520,999,1 1 1 1 1 0 1 1 0 0 0 0,mptmp">
        <slice>
            <filter dst_ip="192.188.124.82" dst_port="53"/>
            <filter dst_ip="192.188.126.3" dst_port="53"/>
        </slice>
        <from usec="0" sec="1194757201"/>
        <to usec="0" sec="1194758102"/>
    </anomaly>
    <anomaly type="anomalous" value="2.512980,1.860560,503,1 1 1 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="133.224.128.232" src_port="80"/>
            <filter src_ip="2.122.208.236" dst_ip="129.60.132.115" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.006420,1.484280,503,1 0 0 1 1 1 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="133.224.155.114" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.571230,1.206280,999,0 0 0 1 1 0 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="132.19.73.40" src_port="25"/>
            <filter src_ip="132.19.73.40" src_port="995"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.969980,1.483220,999,0 0 0 1 1 1 0 0 0 1 1 1,mptpla">
        <slice>
            <filter src_ip="152.174.153.182" dst_ip="48.164.142.81"/>
            <filter src_ip="129.33.172.146" dst_ip="48.164.142.81" src_port="80"/>
            <filter src_ip="129.33.172.146" dst_ip="48.164.142.81" src_port="8080"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.376680,1.137960,503,1 0 0 0 0 0 0 0 0 1 1 1,salphfl">
        <slice>
            <filter src_ip="129.60.209.151" dst_ip="2.122.208.202" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.155080,1.107050,502,1 0 0 1 1 0 0 0 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="220.218.173.248" src_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.006420,1.484280,503,1 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="68.3.114.118" dst_ip="133.224.219.45"/>
            <filter src_ip="68.3.114.118" src_port="80"/>
            <filter dst_ip="133.224.219.45" src_port="80"/>
            <filter dst_ip="133.224.218.189" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.421140,1.206210,503,1 1 0 1 0 0 1 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="129.33.106.146" dst_port="80"/>
            <filter src_ip="129.33.56.187" dst_ip="209.38.18.71" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.323010,1.136580,503,0 0 0 0 0 0 0 0 0 1 1 1,ptmplaHTTP">
        <slice>
            <filter src_ip="2.122.209.23" dst_ip="173.144.70.82" src_port="80" dst_port="2293"/>
            <filter src_ip="2.122.209.23" dst_ip="133.224.129.152" src_port="80" dst_port="2361"/>
            <filter src_ip="2.122.209.23" dst_ip="173.144.68.17" src_port="80" dst_port="1807"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.315020,1.106760,503,0 0 0 1 0 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="129.60.41.137" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.012850,1.000300,999,1 0 0 1 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="129.60.40.47" dst_ip="210.177.231.116"/>
            <filter src_ip="129.60.40.47" dst_port="25"/>
            <filter dst_ip="210.177.231.116" dst_port="25"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.298120,1.127210,503,1 1 0 1 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="133.224.129.153" dst_port="80"/>
            <filter src_ip="173.144.71.73" dst_ip="68.3.114.118" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.591680,1.223960,503,1 1 0 1 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="133.224.128.232" dst_port="80"/>
            <filter src_ip="129.60.132.115" dst_ip="2.122.208.236"/>
            <filter src_ip="129.60.132.115" dst_port="80"/>
            <filter dst_ip="2.122.208.236" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.240430,1.630160,503,1 1 0 1 1 1 1 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="133.224.155.114" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.323010,1.136580,503,0 0 0 0 0 0 0 0 0 1 1 1,mptplaHTTP">
        <slice>
            <filter src_ip="2.122.208.198" dst_ip="133.224.129.153" src_port="80"/>
            <filter src_ip="2.122.194.185" dst_ip="133.224.129.153" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.323010,1.136580,503,0 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="2.122.194.171" src_port="80"/>
            <filter dst_ip="173.144.44.26" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.969980,1.483220,503,0 0 0 1 1 1 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="192.30.105.199" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.102500,1.087100,999,0 0 0 1 0 0 1 0 0 1 1 0,mptmp">
        <slice>
            <filter dst_ip="193.1.192.89"/>
            <filter dst_ip="193.1.192.82"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.001710,1.174330,503,1 1 0 0 0 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="129.60.40.8" dst_ip="192.140.102.167" dst_port="80"/>
            <filter src_ip="129.60.7.20" dst_ip="192.140.102.167" dst_port="80"/>
            <filter src_ip="129.60.30.125" dst_ip="192.140.102.167" dst_port="80"/>
        </slice>
        <from usec="0" sec="1194757563"/>
        <to usec="0" sec="1194757575"/>
    </anomaly>
    <anomaly type="suspicious" value="1.001710,1.174330,503,1 1 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="133.224.212.207" dst_ip="219.22.132.195" dst_port="80"/>
            <filter src_ip="133.224.212.207" dst_ip="2.122.208.247" dst_port="80"/>
            <filter src_ip="133.224.212.207" dst_ip="92.165.225.185" dst_port="80"/>
        </slice>
        <from usec="0" sec="1194758064"/>
        <to usec="0" sec="1194758074"/>
    </anomaly>
    <anomaly type="suspicious" value="1.001710,1.174330,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="173.144.70.190" dst_ip="210.55.117.25" src_port="2637" dst_port="80"/>
        </slice>
        <from usec="0" sec="1194757459"/>
        <to usec="0" sec="1194757873"/>
    </anomaly>
    <anomaly type="suspicious" value="1.001710,1.174330,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="173.144.71.80" dst_ip="2.122.194.153" src_port="1790" dst_port="80"/>
        </slice>
        <from usec="0" sec="1194757393"/>
        <to usec="0" sec="1194757403"/>
    </anomaly>
    <anomaly type="suspicious" value="1.001710,1.174330,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="48.164.142.242" dst_ip="133.224.128.209" src_port="63100" dst_port="80"/>
        </slice>
        <from usec="0" sec="1194757334"/>
        <to usec="0" sec="1194757339"/>
    </anomaly>
    <anomaly type="suspicious" value="0.991138,1.145500,999,1 1 0 1 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="129.60.132.20"/>
        </slice>
        <from usec="0" sec="1194757201"/>
        <to usec="0" sec="1194757697"/>
    </anomaly>
    <anomaly type="suspicious" value="1.001710,1.174330,502,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="129.60.41.11" dst_ip="220.135.7.27" src_port="22" dst_port="52151"/>
        </slice>
        <from usec="0" sec="1194758021"/>
        <to usec="0" sec="1194758026"/>
    </anomaly>
    <anomaly type="suspicious" value="1.001710,1.174330,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="192.196.109.70" dst_port="139"/>
        </slice>
        <from usec="0" sec="1194757474"/>
        <to usec="0" sec="1194757486"/>
    </anomaly>
    <anomaly type="suspicious" value="1.001710,1.174330,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="220.151.165.201" dst_port="139"/>
            <filter src_ip="220.151.165.201" dst_port="445"/>
        </slice>
        <from usec="0" sec="1194758015"/>
        <to usec="0" sec="1194758087"/>
    </anomaly>
    <anomaly type="suspicious" value="1.156700,1.250360,010,1 1 0 0 0 0 1 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="220.157.129.10" dst_port="139"/>
        </slice>
        <from usec="0" sec="1194758051"/>
        <to usec="0" sec="1194758102"/>
    </anomaly>
    <anomaly type="suspicious" value="0.771188,0.997676,999,1 0 0 1 0 0 0 0 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="173.144.68.40" src_port="7134"/>
            <filter src_ip="173.144.68.40" src_port="3963"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.771188,0.997676,503,1 0 0 1 0 0 0 0 0 1 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="129.33.26.72" dst_ip="2.122.224.137" dst_port="80"/>
            <filter src_ip="129.33.26.72" dst_ip="209.192.7.150" dst_port="80"/>
            <filter src_ip="129.33.26.72" dst_ip="208.194.83.25" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.090560,1.105630,501,0 0 0 1 1 0 0 0 0 1 0 0,mptpla">
        <slice>
            <filter src_ip="57.46.180.217" dst_ip="192.30.83.255" src_port="21"/>
            <filter src_ip="57.4.29.158" dst_ip="192.30.83.255" src_port="21"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.957957,1.126600,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="193.1.207.221" dst_ip="48.164.136.85" src_port="80"/>
        </slice>
        <from usec="0" sec="1194757227"/>
        <to usec="0" sec="1194757385"/>
    </anomaly>
    <anomaly type="suspicious" value="0.957957,1.126600,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="173.144.71.189" dst_ip="193.74.21.191" src_port="2139" dst_port="80"/>
            <filter src_ip="173.144.71.189" dst_ip="193.74.21.191" src_port="2108" dst_port="80"/>
            <filter src_ip="173.144.71.189" dst_ip="193.74.21.191" src_port="2093" dst_port="80"/>
        </slice>
        <from usec="0" sec="1194757235"/>
        <to usec="0" sec="1194757371"/>
    </anomaly>
    <anomaly type="suspicious" value="0.957957,1.126600,999,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="192.30.105.169" dst_ip="93.244.155.18" src_port="25"/>
        </slice>
        <from usec="0" sec="1194757421"/>
        <to usec="0" sec="1194757582"/>
    </anomaly>
    <anomaly type="suspicious" value="0.957957,1.126600,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="129.60.133.89" dst_ip="48.164.129.214" src_port="80" dst_port="59268"/>
            <filter src_ip="129.60.133.89" dst_ip="48.164.129.214" src_port="80" dst_port="57012"/>
            <filter src_ip="129.60.133.89" dst_ip="48.164.129.214" src_port="80" dst_port="55586"/>
            <filter src_ip="129.60.133.89" dst_ip="48.164.129.214" src_port="80" dst_port="45246"/>
            <filter src_ip="129.60.133.89" dst_ip="48.164.129.214" src_port="80" dst_port="35877"/>
        </slice>
        <from usec="0" sec="1194757492"/>
        <to usec="0" sec="1194757808"/>
    </anomaly>
    <anomaly type="suspicious" value="0.823832,1.137270,999,1 0 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="222.62.223.180" src_port="43305" dst_port="1027"/>
        </slice>
        <from usec="0" sec="1194757876"/>
        <to usec="0" sec="1194757922"/>
    </anomaly>
    <anomaly type="suspicious" value="0.823832,1.137270,020,1 0 0 0 0 0 1 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="200.85.151.183"/>
        </slice>
        <from usec="0" sec="1194758011"/>
        <to usec="0" sec="1194758057"/>
    </anomaly>
    <anomaly type="suspicious" value="0.823832,1.137270,020,1 0 0 0 0 0 1 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="200.85.148.7"/>
        </slice>
        <from usec="0" sec="1194758011"/>
        <to usec="0" sec="1194758057"/>
    </anomaly>
    <anomaly type="suspicious" value="1.001710,1.174330,999,1 1 0 0 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="173.144.137.83"/>
        </slice>
        <from usec="0" sec="1194757740"/>
        <to usec="0" sec="1194757745"/>
    </anomaly>
    <anomaly type="suspicious" value="1.201970,1.400860,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="193.201.124.125" src_port="1060" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1194757876"/>
        <to usec="0" sec="1194757922"/>
    </anomaly>
    <anomaly type="suspicious" value="1.201970,1.400860,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="219.240.210.27" src_port="1149" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1194757876"/>
        <to usec="0" sec="1194757922"/>
    </anomaly>
    <anomaly type="suspicious" value="1.201970,1.400860,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="218.234.5.135" src_port="1194" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1194757876"/>
        <to usec="0" sec="1194757922"/>
    </anomaly>
    <anomaly type="suspicious" value="1.201970,1.400860,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="220.169.135.19" src_port="1555" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1194757876"/>
        <to usec="0" sec="1194757922"/>
    </anomaly>
    <anomaly type="suspicious" value="1.201970,1.400860,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="93.26.68.242" src_port="2173" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1194757876"/>
        <to usec="0" sec="1194757922"/>
    </anomaly>
    <anomaly type="suspicious" value="1.201970,1.400860,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="89.45.182.52" src_port="3265" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1194757876"/>
        <to usec="0" sec="1194757922"/>
    </anomaly>
    <anomaly type="suspicious" value="1.201970,1.400860,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="93.54.54.37" src_port="4992" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1194757876"/>
        <to usec="0" sec="1194757922"/>
    </anomaly>
    <anomaly type="suspicious" value="1.201970,1.400860,999,0 0 0 0 0 0 1 1 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="192.30.83.63" src_port="20129" dst_port="20129"/>
            <filter dst_ip="192.30.83.63" src_port="20129" dst_port="20129"/>
        </slice>
        <from usec="0" sec="1194757876"/>
        <to usec="0" sec="1194758057"/>
    </anomaly>
    <anomaly type="suspicious" value="1.201970,1.400860,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="193.201.124.125" src_port="1060" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1194758011"/>
        <to usec="0" sec="1194758057"/>
    </anomaly>
    <anomaly type="suspicious" value="1.201970,1.400860,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="219.240.210.27" src_port="1149" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1194758011"/>
        <to usec="0" sec="1194758057"/>
    </anomaly>
    <anomaly type="suspicious" value="1.201970,1.400860,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="218.234.5.135" src_port="1194" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1194758011"/>
        <to usec="0" sec="1194758057"/>
    </anomaly>
    <anomaly type="suspicious" value="1.201970,1.400860,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="220.169.135.19" src_port="1555" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1194758011"/>
        <to usec="0" sec="1194758057"/>
    </anomaly>
    <anomaly type="suspicious" value="1.201970,1.400860,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="93.26.68.242" src_port="2173" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1194758011"/>
        <to usec="0" sec="1194758057"/>
    </anomaly>
    <anomaly type="suspicious" value="1.201970,1.400860,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="89.45.182.52" src_port="3265" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1194758011"/>
        <to usec="0" sec="1194758057"/>
    </anomaly>
    <anomaly type="suspicious" value="1.201970,1.400860,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="93.54.54.37" src_port="4992" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1194758011"/>
        <to usec="0" sec="1194758057"/>
    </anomaly>
    <anomaly type="suspicious" value="1.201970,1.400860,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="129.60.49.11" src_port="22801"/>
        </slice>
        <from usec="0" sec="1194758011"/>
        <to usec="0" sec="1194758102"/>
    </anomaly>
    <anomaly type="suspicious" value="0.938599,0.998724,503,0 0 0 1 0 0 0 0 0 1 1 0,malphfl">
        <slice>
            <filter src_ip="93.123.30.91" dst_ip="129.60.208.45" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.670702,0.996096,503,0 0 0 1 0 0 0 0 0 1 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="133.224.46.8" dst_ip="2.122.208.208" dst_port="80"/>
            <filter src_ip="133.224.46.8" src_port="1025" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.771188,0.997676,503,1 0 0 1 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="133.224.218.189" dst_ip="68.2.213.20" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.686233,1.029120,999,0 0 0 0 0 0 0 0 0 1 0 0,ntscUDP">
        <slice>
            <filter src_ip="133.224.131.44" src_port="53"/>
            <filter src_ip="133.224.131.44" src_port="57454" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.938599,0.998724,503,0 0 0 1 0 0 0 0 0 1 1 0,salphfl">
        <slice>
            <filter src_ip="133.224.157.96" dst_ip="214.110.183.114" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.686233,1.029120,503,0 0 0 0 0 0 0 0 0 1 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="129.33.233.160"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.686233,1.029120,503,0 0 0 0 0 0 0 0 0 1 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="144.45.81.41"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.897465,1.115090,503,0 0 0 0 0 0 1 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="152.174.32.157" dst_ip="193.99.53.125" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.686233,1.029120,999,0 0 0 0 0 0 0 0 0 1 0 0,ntscUDP">
        <slice>
            <filter src_ip="192.30.105.203" src_port="53"/>
            <filter src_ip="192.30.105.203" src_port="32934" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.938599,0.998724,503,0 0 0 1 0 0 0 0 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="193.1.194.7" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.686233,1.029120,503,0 0 0 0 0 0 0 0 0 1 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="2.122.209.22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.686233,1.029120,503,0 0 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="2.122.209.16" dst_ip="133.224.142.197" src_port="80" dst_port="4661"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.949759,1.031670,503,0 0 0 0 0 0 0 0 0 1 1 0,ptmplaHTTP">
        <slice>
            <filter src_ip="210.55.117.25" dst_ip="173.144.70.190" src_port="80" dst_port="2637"/>
            <filter src_ip="210.55.117.25" dst_ip="173.144.70.190" src_port="80" dst_port="2624"/>
            <filter src_ip="210.55.117.25" dst_ip="129.37.80.72"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.784732,1.030650,999,1 0 0 0 0 0 0 0 0 1 0 0,mptpla">
        <slice>
            <filter src_ip="2.122.194.107" dst_ip="173.144.71.185" src_port="80"/>
            <filter src_ip="2.122.194.112" dst_ip="173.144.71.185" src_port="80"/>
            <filter src_ip="218.24.64.55" dst_ip="173.144.71.185" src_port="34036"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.686233,1.029120,503,0 0 0 0 0 0 0 0 0 1 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="152.174.205.86" dst_ip="208.197.136.100" dst_port="80"/>
            <filter src_ip="133.224.85.224" dst_ip="208.197.136.100" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.686233,1.029120,503,0 0 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="133.224.54.152" dst_ip="48.50.119.144" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.949759,1.031670,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="2.122.209.2" dst_ip="129.37.80.58" src_port="80" dst_port="55704"/>
            <filter src_ip="2.122.209.2" dst_ip="129.37.80.58" src_port="80" dst_port="55001"/>
            <filter src_ip="2.122.209.2" dst_ip="129.37.80.58" src_port="80" dst_port="53047"/>
            <filter src_ip="2.122.209.2" dst_ip="129.37.80.58" src_port="80" dst_port="52779"/>
            <filter src_ip="2.122.209.2" dst_ip="129.37.80.58" src_port="80" dst_port="52697"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.949759,1.031670,503,0 0 0 0 0 0 0 0 0 1 1 0,ptmplaHTTP">
        <slice>
            <filter src_ip="132.19.74.88" dst_ip="48.164.157.54" src_port="80"/>
            <filter src_ip="132.19.74.88" dst_ip="193.51.208.195" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.949759,1.031670,503,0 0 0 0 0 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter src_ip="129.33.64.211" dst_ip="2.122.209.11" src_port="51413" dst_port="80"/>
            <filter src_ip="129.60.208.45" dst_ip="2.122.209.11" src_port="58192" dst_port="80"/>
            <filter src_ip="173.144.70.189" dst_ip="2.122.209.11" src_port="1891" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.949759,1.031670,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="129.33.0.167" dst_ip="2.122.209.39" src_port="4814" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.949759,1.031670,503,0 0 0 0 0 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter src_ip="2.122.208.226" dst_ip="133.224.200.136" src_port="80"/>
            <filter src_ip="197.37.107.224" dst_ip="133.224.200.136" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.949759,1.031670,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="133.224.128.209" dst_ip="48.164.142.242" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.949759,1.031670,503,0 0 0 0 0 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter src_ip="152.174.212.146" dst_ip="48.164.129.43" src_port="80"/>
            <filter src_ip="129.33.27.70" dst_ip="48.164.129.43" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
