<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="anomalous" value="2.573360,1.885250,503,1 1 0 1 1 0 1 1 0 1 1 1,mptmp">
        <slice>
            <filter dst_port="80"/>
            <filter src_ip="209.41.4.255" src_port="3128"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.669290,2.019590,503,1 1 1 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="208.142.229.59" dst_port="80"/>
            <filter src_ip="144.128.165.49" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.984470,1.865500,502,1 1 0 1 0 0 1 1 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="210.143.110.219" dst_port="22"/>
        </slice>
        <from usec="0" sec="1197435600"/>
        <to usec="0" sec="1197436500"/>
    </anomaly>
    <anomaly type="anomalous" value="2.669290,2.019590,503,1 1 1 1 1 1 0 0 0 1 1 1,mptplaHTTP">
        <slice>
            <filter src_ip="81.117.30.40" dst_ip="135.6.165.124" dst_port="33437"/>
            <filter src_ip="144.195.151.218" dst_ip="135.6.165.124" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.837800,1.794450,999,1 0 0 1 0 0 1 1 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="170.248.24.212" src_port="59912" dst_port="33434"/>
            <filter src_ip="170.248.24.212"/>
        </slice>
        <from usec="0" sec="1197435600"/>
        <to usec="0" sec="1197436456"/>
    </anomaly>
    <anomaly type="anomalous" value="1.984470,1.865500,999,1 1 0 1 0 0 1 1 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="170.248.24.215" src_port="3124"/>
            <filter src_ip="170.248.24.215" dst_ip="213.123.108.239" src_port="3128"/>
        </slice>
        <from usec="0" sec="1197435600"/>
        <to usec="0" sec="1197436417"/>
    </anomaly>
    <anomaly type="anomalous" value="1.724330,1.549800,503,1 0 0 1 1 1 0 0 0 1 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="209.41.13.220" src_port="80"/>
            <filter src_ip="209.41.13.220" src_port="21"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.699020,1.406950,503,0 0 0 1 1 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="128.71.94.209" src_port="80"/>
            <filter dst_ip="128.71.193.211" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.938550,1.814670,501,1 1 1 1 1 0 0 0 0 1 0 0,mptpla">
        <slice>
            <filter dst_ip="209.41.13.220" dst_port="21"/>
            <filter src_ip="33.15.87.90" dst_ip="209.41.13.220" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.476310,1.386960,503,0 0 0 1 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="208.131.141.239" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="5.936060,5.049320,503,1 0 0 1 1 1 1 1 1 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="144.128.165.226" dst_ip="206.163.44.29" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.855420,1.849240,501,1 1 1 1 1 0 0 0 0 0 0 0,heavy_hitter">
        <slice>
            <filter src_ip="209.41.8.119" dst_ip="206.160.152.123" src_port="21"/>
        </slice>
        <from usec="0" sec="1197435600"/>
        <to usec="0" sec="1197436428"/>
    </anomaly>
    <anomaly type="anomalous" value="2.062400,1.831250,502,1 1 0 1 0 0 1 1 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="210.143.110.219" src_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.359720,1.315000,503,1 0 0 1 1 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="170.248.24.136" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.617220,1.613100,999,0 0 0 1 1 1 0 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="46.208.168.243" src_port="3127"/>
            <filter dst_ip="46.208.168.243" src_port="3128"/>
            <filter dst_ip="46.208.168.243" src_port="3124"/>
        </slice>
        <from usec="0" sec="1197435600"/>
        <to usec="0" sec="1197435888"/>
    </anomaly>
    <anomaly type="anomalous" value="2.142970,1.618750,503,0 0 0 1 1 1 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="128.71.218.5" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.874020,1.563220,503,0 0 0 1 1 1 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="41.232.47.105" src_port="80"/>
            <filter dst_ip="128.71.21.232" src_port="80"/>
            <filter src_ip="41.232.46.73" dst_ip="128.71.236.97" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.302500,1.850740,999,0 0 0 0 0 0 1 1 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="209.41.4.255" dst_port="3128"/>
            <filter dst_ip="209.41.4.255"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.798980,2.209900,010,1 1 1 0 0 0 1 1 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="208.213.202.131" dst_port="135"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.910600,1.779610,020,0 0 0 1 0 0 1 1 0 1 0 0,icmp_error">
        <slice>
            <filter dst_ip="209.41.8.96"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.573360,1.885250,999,1 1 0 1 1 0 1 1 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="209.41.4.242"/>
            <filter src_ip="209.41.4.254" dst_ip="208.69.107.62"/>
            <filter src_ip="209.41.4.254" src_port="3128"/>
            <filter dst_ip="208.69.107.62" src_port="3128"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.510680,1.479920,503,1 0 0 0 0 0 1 0 0 1 0 1,mptpHTTP">
        <slice>
            <filter dst_ip="208.142.228.223" src_port="80"/>
            <filter dst_ip="208.142.228.223" dst_port="23076"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.487150,1.401220,012,1 0 0 0 0 0 0 0 0 1 1 1,mptpla">
        <slice>
            <filter src_ip="209.41.9.64" dst_ip="203.75.252.192" src_port="993"/>
            <filter src_ip="135.216.155.232" dst_ip="203.75.252.192" src_port="993"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.142970,1.618750,503,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="135.216.147.169"/>
            <filter dst_ip="128.71.224.131" src_port="80"/>
            <filter dst_ip="208.142.224.178" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.099920,1.867610,999,1 1 1 1 1 0 1 0 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="208.32.125.70" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.142970,1.618750,503,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="201.64.194.204" src_port="80"/>
            <filter dst_ip="170.248.132.104" src_port="80"/>
            <filter src_ip="201.64.194.209" dst_ip="208.142.41.198" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.142970,1.618750,503,0 0 0 1 1 1 0 0 0 1 1 1,salphfl">
        <slice>
            <filter src_ip="41.232.46.20" dst_ip="170.248.148.82" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.292220,2.163100,999,0 0 1 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="208.32.126.131" dst_port="53"/>
        </slice>
        <from usec="0" sec="1197435600"/>
        <to usec="0" sec="1197436501"/>
    </anomaly>
    <anomaly type="anomalous" value="2.152870,1.595850,503,1 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="208.142.224.178" dst_port="80"/>
            <filter dst_ip="81.113.196.178" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.885330,1.539500,503,1 0 0 1 1 1 0 0 0 1 1 0,salphfl">
        <slice>
            <filter src_ip="128.71.33.78" dst_ip="209.35.34.79" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.142970,1.618750,503,0 0 0 1 1 1 0 0 0 1 1 1,mptplaHTTP">
        <slice>
            <filter src_ip="208.20.146.6" dst_ip="128.71.197.32" src_port="80"/>
            <filter src_ip="81.113.196.178" dst_ip="128.71.197.32" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.905770,1.790370,503,1 1 1 1 0 0 0 0 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="208.142.228.56" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.490640,1.360170,503,1 0 0 1 0 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="208.131.141.239" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.142970,1.618750,503,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="208.142.228.56" src_port="80"/>
            <filter dst_ip="135.198.52.158" src_port="80"/>
            <filter dst_ip="135.198.52.159" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.289980,1.677880,503,0 0 0 1 1 1 1 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="135.198.52.153" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.695210,1.430040,503,1 0 0 1 0 0 1 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="128.71.40.67" src_port="80"/>
            <filter dst_ip="128.71.193.211" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.874020,1.563220,999,0 0 0 1 1 1 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="152.147.110.96" dst_ip="24.22.196.110"/>
            <filter src_ip="152.147.110.96" src_port="80"/>
            <filter src_ip="135.192.168.173" dst_ip="24.22.196.110" src_port="80"/>
            <filter src_ip="135.192.168.173" dst_ip="24.22.196.110" src_port="8080"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.476310,1.386960,503,0 0 0 1 0 0 0 0 0 1 1 1,mptplaHTTP">
        <slice>
            <filter dst_ip="128.71.73.221" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.472780,1.427240,010,0 0 0 0 0 0 0 0 0 1 1 1,DDoSSYN">
        <slice>
            <filter dst_ip="208.142.228.223" dst_port="23076"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.490640,1.360170,503,1 0 0 1 0 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="128.71.40.67" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.128080,1.481710,999,0 0 0 0 0 0 0 0 0 0 0 1,mptpla">
        <slice>
            <filter src_ip="144.128.165.226" dst_ip="81.246.196.218"/>
            <filter src_ip="144.128.166.1" dst_ip="81.246.196.218" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.697640,1.777530,502,1 0 1 1 1 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="210.143.110.219" dst_port="22"/>
        </slice>
        <from usec="0" sec="1197435600"/>
        <to usec="0" sec="1197436428"/>
    </anomaly>
    <anomaly type="suspicious" value="1.650760,1.864730,503,1 1 1 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="209.41.15.52" dst_ip="16.218.11.190" dst_port="80"/>
        </slice>
        <from usec="0" sec="1197436469"/>
        <to usec="0" sec="1197436473"/>
    </anomaly>
    <anomaly type="suspicious" value="1.300700,1.430660,999,1 1 0 0 0 0 0 0 0 1 1 0,ptmpla">
        <slice>
            <filter src_ip="209.41.8.228" dst_ip="26.130.146.112" dst_port="995"/>
            <filter src_ip="209.41.8.228" dst_ip="117.205.228.188" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.650760,1.864730,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="204.218.33.96" src_port="34723" dst_port="1026"/>
        </slice>
        <from usec="0" sec="1197436292"/>
        <to usec="0" sec="1197436294"/>
    </anomaly>
    <anomaly type="suspicious" value="1.650760,1.864730,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="197.14.37.136" dst_port="22"/>
        </slice>
        <from usec="0" sec="1197435771"/>
        <to usec="0" sec="1197435780"/>
    </anomaly>
    <anomaly type="suspicious" value="1.650760,1.864730,503,1 1 1 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="128.71.206.155" dst_ip="81.97.56.211" dst_port="80"/>
        </slice>
        <from usec="0" sec="1197436419"/>
        <to usec="0" sec="1197436423"/>
    </anomaly>
    <anomaly type="suspicious" value="1.837580,1.916280,999,1 1 1 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="204.219.135.111" src_port="37424" dst_port="1027"/>
            <filter src_ip="204.219.135.111" src_port="37424" dst_port="1026"/>
        </slice>
        <from usec="0" sec="1197435825"/>
        <to usec="0" sec="1197435871"/>
    </anomaly>
    <anomaly type="suspicious" value="1.304700,1.390480,503,1 1 0 1 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="128.71.193.211" dst_port="80"/>
            <filter dst_ip="41.232.46.124" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.125910,1.327040,503,1 0 0 1 1 0 0 0 0 1 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="170.248.24.136" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.953821,1.400450,999,0 0 0 1 1 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="135.198.165.221" dst_port="25"/>
        </slice>
        <from usec="0" sec="1197435600"/>
        <to usec="0" sec="1197435707"/>
    </anomaly>
    <anomaly type="suspicious" value="0.953821,1.400450,999,0 0 0 1 1 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="135.216.1.104" dst_ip="199.113.69.94" dst_port="2703"/>
            <filter src_ip="128.71.4.216" dst_ip="199.113.69.94" dst_port="2703"/>
        </slice>
        <from usec="0" sec="1197435602"/>
        <to usec="0" sec="1197435887"/>
    </anomaly>
    <anomaly type="suspicious" value="0.953821,1.400450,501,0 0 0 1 1 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter src_ip="46.63.33.40" dst_ip="209.41.8.119"/>
            <filter src_ip="46.63.33.40" dst_port="21"/>
            <filter dst_ip="209.41.8.119" dst_port="21"/>
        </slice>
        <from usec="0" sec="1197435600"/>
        <to usec="0" sec="1197436158"/>
    </anomaly>
    <anomaly type="suspicious" value="0.953821,1.400450,999,0 0 0 1 1 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="128.71.69.106" src_port="25"/>
            <filter dst_ip="128.71.69.106" dst_port="25"/>
        </slice>
        <from usec="0" sec="1197435600"/>
        <to usec="0" sec="1197435888"/>
    </anomaly>
    <anomaly type="suspicious" value="0.953821,1.400450,503,0 0 0 1 1 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="209.152.207.54" dst_ip="128.71.124.212" src_port="80"/>
            <filter src_ip="209.152.207.193" dst_ip="128.71.124.212" src_port="80"/>
        </slice>
        <from usec="0" sec="1197435867"/>
        <to usec="0" sec="1197436060"/>
    </anomaly>
    <anomaly type="suspicious" value="0.953821,1.400450,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="144.128.112.237" dst_ip="209.115.44.198" dst_port="80"/>
        </slice>
        <from usec="0" sec="1197435601"/>
        <to usec="0" sec="1197436126"/>
    </anomaly>
    <anomaly type="suspicious" value="0.953821,1.400450,999,0 0 0 1 1 0 0 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="170.248.36.128" dst_port="8985"/>
        </slice>
        <from usec="0" sec="1197435602"/>
        <to usec="0" sec="1197436150"/>
    </anomaly>
    <anomaly type="suspicious" value="0.953821,1.400450,901,0 0 0 1 1 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="209.152.207.198" dst_ip="135.216.130.51" src_port="80" dst_port="2211"/>
        </slice>
        <from usec="0" sec="1197436059"/>
        <to usec="0" sec="1197436060"/>
    </anomaly>
    <anomaly type="suspicious" value="0.953821,1.400450,010,0 0 0 1 1 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="206.128.128.7"/>
        </slice>
        <from usec="0" sec="1197435603"/>
        <to usec="0" sec="1197436331"/>
    </anomaly>
    <anomaly type="suspicious" value="0.953821,1.400450,999,0 0 0 1 1 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="128.71.146.186" dst_port="995"/>
            <filter src_ip="16.213.42.223" dst_ip="128.71.146.186" src_port="25"/>
        </slice>
        <from usec="0" sec="1197435693"/>
        <to usec="0" sec="1197436311"/>
    </anomaly>
    <anomaly type="suspicious" value="0.953821,1.400450,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="128.71.84.190" dst_ip="197.170.116.174" dst_port="80"/>
        </slice>
        <from usec="0" sec="1197436282"/>
        <to usec="0" sec="1197436284"/>
    </anomaly>
    <anomaly type="suspicious" value="1.125910,1.327040,503,1 0 0 1 1 0 0 0 0 1 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="209.41.6.127" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.053880,1.441730,503,1 1 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="144.128.112.237" dst_ip="44.91.45.16" src_port="1345" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.048400,1.321740,503,0 0 0 1 0 0 0 0 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="41.232.46.106" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.063600,1.336690,503,1 0 0 0 0 0 0 0 0 1 1 0,ptmplaHTTP">
        <slice>
            <filter src_ip="128.71.197.32" dst_ip="208.20.146.6" dst_port="80"/>
            <filter src_ip="128.71.197.32" dst_ip="81.113.196.178" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.043420,1.363950,503,0 0 0 0 0 0 0 0 0 1 1 0,ptmplaHTTP">
        <slice>
            <filter src_ip="135.216.83.164" dst_ip="24.22.196.225" src_port="80" dst_port="38533"/>
            <filter src_ip="135.216.83.164" dst_ip="81.65.34.9" src_port="80" dst_port="50620"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.043420,1.363950,504,0 0 0 0 0 0 0 0 0 1 1 0,ptmpla">
        <slice>
            <filter src_ip="135.216.171.229" dst_ip="208.2.140.130" dst_port="443"/>
            <filter src_ip="135.216.171.229" dst_ip="197.71.168.61" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.043420,1.363950,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="197.209.62.203" dst_ip="128.71.198.138" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.043420,1.363950,999,0 0 0 0 0 0 0 0 0 1 1 0,ntscUDP">
        <slice>
            <filter src_ip="203.130.71.87" src_port="1094" dst_port="1434"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.043420,1.363950,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="208.20.144.25" dst_ip="128.71.142.93" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.043420,1.363950,503,0 0 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="41.232.46.88" dst_ip="170.248.28.237" src_port="80"/>
            <filter src_ip="81.113.196.178" dst_ip="128.71.197.44" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.043420,1.363950,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="196.106.29.102" dst_ip="128.71.9.37" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.043420,1.363950,999,0 0 0 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="128.71.21.165" dst_port="7566"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.043420,1.363950,503,0 0 0 0 0 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter src_ip="41.232.46.101" dst_ip="135.216.25.183" src_port="80"/>
            <filter src_ip="41.232.46.105" dst_ip="135.216.25.183" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.043420,1.363950,503,0 0 0 0 0 0 0 0 0 1 1 0,ptmplaHTTP">
        <slice>
            <filter src_ip="169.45.152.12" dst_ip="26.123.45.9" src_port="49298" dst_port="80"/>
            <filter src_ip="169.45.152.12" dst_ip="203.84.2.162" src_port="49292" dst_port="80"/>
            <filter src_ip="169.45.152.12" dst_ip="101.16.64.192" src_port="49296" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.043420,1.363950,999,0 0 0 0 0 0 0 0 0 1 1 0,mptpla">
        <slice>
            <filter src_ip="135.192.69.202" dst_ip="24.22.196.120" src_port="80" dst_port="43478"/>
            <filter src_ip="135.192.69.202" dst_ip="24.22.196.120" src_port="80" dst_port="41483"/>
            <filter src_ip="152.147.110.106" dst_ip="24.22.196.120" src_port="21567" dst_port="58793"/>
            <filter src_ip="152.147.110.106" dst_ip="24.22.196.120" src_port="21" dst_port="41405"/>
            <filter src_ip="152.147.230.78" dst_ip="24.22.196.120" src_port="80" dst_port="43600"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.043420,1.363950,503,0 0 0 0 0 0 0 0 0 1 1 0,malphfl">
        <slice>
            <filter src_ip="128.71.220.68" dst_ip="24.22.207.72" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
