<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="anomalous" value="0.890688,0.889824,020,1 1 0 0 0 0 1 1 1 0 0 0,ntscICec">
        <slice>
            <filter src_ip="195.195.170.192"/>
        </slice>
        <from usec="0" sec="1199163780"/>
        <to usec="0" sec="1199164500"/>
    </anomaly>
    <anomaly type="anomalous" value="1.879120,1.496900,010,1 1 1 1 1 1 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="5.70.51.183" src_port="6000" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1199163836"/>
        <to usec="0" sec="1199163866"/>
    </anomaly>
    <anomaly type="anomalous" value="1.375300,1.279300,503,1 1 1 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="171.27.216.164" dst_ip="71.228.88.131" dst_port="80"/>
        </slice>
        <from usec="0" sec="1199163701"/>
        <to usec="0" sec="1199164397"/>
    </anomaly>
    <anomaly type="anomalous" value="1.375300,1.279300,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="223.167.105.39" src_port="6000" dst_port="2967"/>
        </slice>
        <from usec="0" sec="1199164098"/>
        <to usec="0" sec="1199164099"/>
    </anomaly>
    <anomaly type="anomalous" value="1.258860,1.063170,501,1 1 0 1 1 0 1 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="4.214.159.122" dst_ip="195.195.161.197" dst_port="21"/>
            <filter src_ip="72.192.64.38" dst_ip="195.195.161.197" dst_port="21"/>
        </slice>
        <from usec="0" sec="1199163600"/>
        <to usec="0" sec="1199164428"/>
    </anomaly>
    <anomaly type="anomalous" value="1.535020,1.224730,503,1 1 0 1 1 1 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="152.131.12.30" dst_port="80"/>
        </slice>
        <from usec="0" sec="1199163600"/>
        <to usec="0" sec="1199163916"/>
    </anomaly>
    <anomaly type="anomalous" value="1.375300,1.279300,503,1 1 1 0 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="195.195.164.146" dst_port="80"/>
        </slice>
        <from usec="0" sec="1199163611"/>
        <to usec="0" sec="1199164498"/>
    </anomaly>
    <anomaly type="anomalous" value="1.868040,1.410860,999,1 1 1 1 1 1 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="218.26.132.214" dst_port="1026"/>
            <filter src_ip="218.26.132.214" dst_port="1027"/>
        </slice>
        <from usec="0" sec="1199163735"/>
        <to usec="0" sec="1199163781"/>
    </anomaly>
    <anomaly type="anomalous" value="1.648640,1.273150,999,1 1 1 1 1 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="218.27.64.12" dst_port="1027"/>
            <filter src_port="36258" dst_port="1027"/>
            <filter src_ip="218.27.64.12" src_port="36258" dst_port="1026"/>
        </slice>
        <from usec="0" sec="1199163735"/>
        <to usec="0" sec="1199163781"/>
    </anomaly>
    <anomaly type="anomalous" value="1.868040,1.410860,999,1 1 1 1 1 1 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="223.174.163.85" dst_port="1026"/>
            <filter src_ip="223.174.163.85" dst_port="1027"/>
        </slice>
        <from usec="0" sec="1199163735"/>
        <to usec="0" sec="1199163797"/>
    </anomaly>
    <anomaly type="anomalous" value="1.375300,1.279300,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="194.29.144.242" src_port="43438" dst_port="1026"/>
        </slice>
        <from usec="0" sec="1199164226"/>
        <to usec="0" sec="1199164229"/>
    </anomaly>
    <anomaly type="anomalous" value="0.890688,0.889824,010,1 1 0 0 0 0 1 1 1 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="219.91.239.29" dst_port="445"/>
        </slice>
        <from usec="0" sec="1199163780"/>
        <to usec="0" sec="1199163826"/>
    </anomaly>
    <anomaly type="anomalous" value="1.429220,1.245920,503,0 0 0 1 1 1 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="152.131.12.30" src_port="80"/>
        </slice>
        <from usec="0" sec="1199163600"/>
        <to usec="0" sec="1199163888"/>
    </anomaly>
    <anomaly type="anomalous" value="1.180970,1.086950,503,1 0 0 1 1 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="195.195.170.174" src_port="80"/>
        </slice>
        <from usec="0" sec="1199163600"/>
        <to usec="0" sec="1199164248"/>
    </anomaly>
    <anomaly type="anomalous" value="1.868040,1.410860,502,1 1 1 1 1 1 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="45.52.160.130" src_port="22"/>
        </slice>
        <from usec="0" sec="1199163600"/>
        <to usec="0" sec="1199164498"/>
    </anomaly>
    <anomaly type="anomalous" value="1.429220,1.245920,503,0 0 0 1 1 1 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="5.203.226.72" dst_ip="171.27.34.15" src_port="80" dst_port="1109"/>
            <filter src_ip="5.203.226.72" dst_ip="171.27.34.15" src_port="80" dst_port="1108"/>
            <filter src_ip="5.203.226.72" dst_ip="171.27.176.155" src_port="80" dst_port="3332"/>
            <filter src_ip="5.203.226.72" dst_ip="171.27.176.155" src_port="80" dst_port="3331"/>
        </slice>
        <from usec="0" sec="1199163992"/>
        <to usec="0" sec="1199164173"/>
    </anomaly>
    <anomaly type="anomalous" value="1.127440,1.087520,503,0 0 0 1 1 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="171.27.37.164" src_port="80"/>
        </slice>
        <from usec="0" sec="1199164109"/>
        <to usec="0" sec="1199164337"/>
    </anomaly>
    <anomaly type="anomalous" value="1.429220,1.245920,503,0 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="5.203.227.42" dst_ip="171.27.37.116" src_port="80" dst_port="1369"/>
        </slice>
        <from usec="0" sec="1199164208"/>
        <to usec="0" sec="1199164413"/>
    </anomaly>
    <anomaly type="anomalous" value="1.429220,1.245920,501,0 0 0 1 1 1 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="195.195.161.197" dst_ip="219.50.234.134" src_port="21"/>
            <filter src_ip="195.195.161.197" dst_ip="72.192.64.38" src_port="21"/>
        </slice>
        <from usec="0" sec="1199163600"/>
        <to usec="0" sec="1199164428"/>
    </anomaly>
    <anomaly type="anomalous" value="1.429220,1.245920,503,0 0 0 1 1 1 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="194.84.65.181" dst_ip="171.27.154.9" src_port="80"/>
        </slice>
        <from usec="0" sec="1199163600"/>
        <to usec="0" sec="1199163751"/>
    </anomaly>
    <anomaly type="anomalous" value="1.429220,1.245920,503,0 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="208.117.73.110" dst_ip="158.118.89.233" src_port="80"/>
        </slice>
        <from usec="0" sec="1199163600"/>
        <to usec="0" sec="1199164032"/>
    </anomaly>
    <anomaly type="anomalous" value="1.471820,1.245420,503,1 0 0 1 1 1 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="195.195.170.174" dst_port="80"/>
        </slice>
        <from usec="0" sec="1199163844"/>
        <to usec="0" sec="1199164498"/>
    </anomaly>
    <anomaly type="anomalous" value="1.429220,1.245920,503,0 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="71.228.88.131" dst_ip="171.27.216.164" src_port="80"/>
        </slice>
        <from usec="0" sec="1199163600"/>
        <to usec="0" sec="1199164248"/>
    </anomaly>
    <anomaly type="anomalous" value="1.108880,0.965664,999,0 0 0 1 1 0 1 1 1 0 0 0,ntscACK">
        <slice>
            <filter src_ip="152.30.77.118" src_port="63789"/>
        </slice>
        <from usec="0" sec="1199163600"/>
        <to usec="0" sec="1199164428"/>
    </anomaly>
    <anomaly type="anomalous" value="1.127440,1.087520,503,0 0 0 1 1 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="5.203.226.58" dst_ip="171.27.154.9" src_port="80"/>
        </slice>
        <from usec="0" sec="1199164350"/>
        <to usec="0" sec="1199164414"/>
    </anomaly>
    <anomaly type="anomalous" value="1.868040,1.410860,502,1 1 1 1 1 1 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="41.131.193.208" dst_port="22"/>
        </slice>
        <from usec="0" sec="1199163600"/>
        <to usec="0" sec="1199164499"/>
    </anomaly>
    <anomaly type="anomalous" value="1.360130,1.177460,503,1 1 1 0 0 0 1 1 1 0 0 0,ntscACK">
        <slice>
            <filter src_ip="158.118.89.233" dst_port="80"/>
        </slice>
        <from usec="0" sec="1199163600"/>
        <to usec="0" sec="1199164498"/>
    </anomaly>
    <anomaly type="anomalous" value="1.868040,1.410860,502,1 1 1 1 1 1 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_ip="195.195.168.39"/>
            <filter dst_ip="41.131.193.208" src_port="22"/>
        </slice>
        <from usec="0" sec="1199163600"/>
        <to usec="0" sec="1199164485"/>
    </anomaly>
    <anomaly type="anomalous" value="1.481840,1.205220,020,1 1 1 1 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="195.195.161.196"/>
        </slice>
        <from usec="0" sec="1199163600"/>
        <to usec="0" sec="1199164451"/>
    </anomaly>
    <anomaly type="anomalous" value="1.067350,0.926254,020,1 1 0 1 0 0 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="195.195.168.39"/>
        </slice>
        <from usec="0" sec="1199163600"/>
        <to usec="0" sec="1199164489"/>
    </anomaly>
    <anomaly type="anomalous" value="1.414630,1.141110,999,0 0 0 1 1 1 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="171.27.24.158" dst_port="33457"/>
            <filter src_ip="171.27.24.158"/>
        </slice>
        <from usec="0" sec="1199163600"/>
        <to usec="0" sec="1199164411"/>
    </anomaly>
    <anomaly type="anomalous" value="1.559790,1.181480,999,1 1 0 1 1 1 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="194.162.48.185" src_port="58911" dst_port="33434"/>
        </slice>
        <from usec="0" sec="1199163600"/>
        <to usec="0" sec="1199163978"/>
    </anomaly>
    <anomaly type="anomalous" value="1.163270,0.965019,999,1 0 0 1 1 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="194.127.63.29" dst_port="53"/>
        </slice>
        <from usec="0" sec="1199163600"/>
        <to usec="0" sec="1199164428"/>
    </anomaly>
    <anomaly type="suspicious" value="0.725687,0.973121,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="157.51.175.135" dst_ip="158.118.89.233" src_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1199163794"/>
        <to usec="0" sec="1199163806"/>
    </anomaly>
    <anomaly type="suspicious" value="0.725687,0.973121,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="171.27.198.21" dst_ip="218.4.179.19" src_port="2424" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1199163729"/>
        <to usec="0" sec="1199164124"/>
    </anomaly>
    <anomaly type="suspicious" value="0.725687,0.973121,999,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="158.118.8.203" dst_ip="121.145.77.170" src_port="1744" dst_port="16789" proto="tcp"/>
        </slice>
        <from usec="0" sec="1199164112"/>
        <to usec="0" sec="1199164462"/>
    </anomaly>
    <anomaly type="suspicious" value="0.725687,0.973121,999,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="84.62.247.237" dst_ip="171.27.199.119" src_port="2376" dst_port="7100" proto="udp"/>
        </slice>
        <from usec="0" sec="1199164453"/>
        <to usec="0" sec="1199164456"/>
    </anomaly>
    <anomaly type="suspicious" value="0.725687,0.973121,503,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="223.254.226.124" dst_ip="195.195.170.174" src_port="2367" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1199163723"/>
        <to usec="0" sec="1199163727"/>
    </anomaly>
    <anomaly type="suspicious" value="0.725687,0.973121,999,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="47.83.173.60" dst_ip="195.195.168.38" src_port="1215" dst_port="8080" proto="tcp"/>
        </slice>
        <from usec="0" sec="1199163982"/>
        <to usec="0" sec="1199163986"/>
    </anomaly>
    <anomaly type="suspicious" value="0.725687,0.973121,901,1 0 0 0 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="198.79.219.218" dst_ip="198.79.219.218" src_port="3124" proto="tcp"/>
        </slice>
        <from usec="0" sec="1199163717"/>
        <to usec="0" sec="1199163830"/>
    </anomaly>
    <anomaly type="suspicious" value="0.725687,0.973121,002,1 0 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="72.235.36.124" src_port="1030" dst_port="137" proto="udp"/>
        </slice>
        <from usec="0" sec="1199163751"/>
        <to usec="0" sec="1199163754"/>
    </anomaly>
    <anomaly type="suspicious" value="0.725687,0.973121,002,1 0 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="1.132.183.42" src_port="1092" dst_port="137" proto="udp"/>
        </slice>
        <from usec="0" sec="1199163851"/>
        <to usec="0" sec="1199163858"/>
    </anomaly>
    <anomaly type="suspicious" value="0.725687,0.973121,503,1 0 0 0 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="171.27.24.219" dst_port="80"/>
        </slice>
        <from usec="0" sec="1199163844"/>
        <to usec="0" sec="1199164380"/>
    </anomaly>
    <anomaly type="suspicious" value="0.913684,1.020780,999,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="218.26.132.209" src_port="48696" dst_port="1026"/>
            <filter src_ip="218.26.132.209" src_port="48696" dst_port="1027"/>
        </slice>
        <from usec="0" sec="1199164136"/>
        <to usec="0" sec="1199164139"/>
    </anomaly>
    <anomaly type="suspicious" value="0.913684,1.020780,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="171.27.196.207" dst_ip="41.68.192.53" src_port="54801" dst_port="80"/>
        </slice>
        <from usec="0" sec="1199163845"/>
        <to usec="0" sec="1199164496"/>
    </anomaly>
    <anomaly type="suspicious" value="0.913684,1.020780,999,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="36.191.79.255" dst_ip="152.131.12.148" src_port="25"/>
        </slice>
        <from usec="0" sec="1199164110"/>
        <to usec="0" sec="1199164120"/>
    </anomaly>
    <anomaly type="suspicious" value="0.913684,1.020780,999,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="218.27.64.3" src_port="60503" dst_port="1027"/>
            <filter src_ip="218.27.64.3" src_port="60503" dst_port="1026"/>
        </slice>
        <from usec="0" sec="1199164483"/>
        <to usec="0" sec="1199164488"/>
    </anomaly>
    <anomaly type="suspicious" value="0.913684,1.020780,002,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="84.52.84.36" src_port="1026" dst_port="137"/>
        </slice>
        <from usec="0" sec="1199164354"/>
        <to usec="0" sec="1199164369"/>
    </anomaly>
    <anomaly type="suspicious" value="0.913684,1.020780,002,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="193.187.96.37" src_port="1025" dst_port="137"/>
        </slice>
        <from usec="0" sec="1199164213"/>
        <to usec="0" sec="1199164225"/>
    </anomaly>
    <anomaly type="suspicious" value="0.913684,1.020780,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="200.237.178.140"/>
        </slice>
        <from usec="0" sec="1199164076"/>
        <to usec="0" sec="1199164088"/>
    </anomaly>
    <anomaly type="suspicious" value="0.913684,1.020780,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="220.121.69.47"/>
        </slice>
        <from usec="0" sec="1199164110"/>
        <to usec="0" sec="1199164120"/>
    </anomaly>
    <anomaly type="suspicious" value="0.913684,1.020780,002,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="85.197.20.181" dst_port="137"/>
        </slice>
        <from usec="0" sec="1199164117"/>
        <to usec="0" sec="1199164131"/>
    </anomaly>
    <anomaly type="suspicious" value="0.913684,1.020780,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="84.49.237.175" dst_port="139"/>
        </slice>
        <from usec="0" sec="1199164481"/>
        <to usec="0" sec="1199164500"/>
    </anomaly>
    <anomaly type="suspicious" value="0.913684,1.020780,010,1 1 0 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="2.175.64.82" dst_port="25"/>
        </slice>
        <from usec="0" sec="1199164331"/>
        <to usec="0" sec="1199164346"/>
    </anomaly>
    <anomaly type="suspicious" value="0.913684,1.020780,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="80.115.112.206" dst_port="139"/>
        </slice>
        <from usec="0" sec="1199164100"/>
        <to usec="0" sec="1199164130"/>
    </anomaly>
    <anomaly type="suspicious" value="0.913684,1.020780,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="4.138.196.78" dst_port="25"/>
        </slice>
        <from usec="0" sec="1199164417"/>
        <to usec="0" sec="1199164498"/>
    </anomaly>
    <anomaly type="suspicious" value="0.913684,1.020780,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="206.193.161.167" dst_port="139"/>
        </slice>
        <from usec="0" sec="1199164057"/>
        <to usec="0" sec="1199164063"/>
    </anomaly>
    <anomaly type="suspicious" value="0.913684,1.020780,002,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="35.51.129.234" dst_port="137"/>
        </slice>
        <from usec="0" sec="1199164037"/>
        <to usec="0" sec="1199164052"/>
    </anomaly>
    <anomaly type="suspicious" value="0.913684,1.020780,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="85.225.169.103" dst_port="139"/>
            <filter src_ip="85.225.169.103" dst_port="445"/>
        </slice>
        <from usec="0" sec="1199163837"/>
        <to usec="0" sec="1199163895"/>
    </anomaly>
    <anomaly type="suspicious" value="0.865421,1.007160,999,0 0 0 1 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="152.131.12.92"/>
        </slice>
        <from usec="0" sec="1199163600"/>
        <to usec="0" sec="1199163674"/>
    </anomaly>
    <anomaly type="suspicious" value="0.865421,1.007160,503,0 0 0 1 0 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="43.71.225.181"/>
        </slice>
        <from usec="0" sec="1199163601"/>
        <to usec="0" sec="1199163706"/>
    </anomaly>
    <anomaly type="suspicious" value="0.865421,1.007160,503,0 0 0 1 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="5.203.226.50"/>
        </slice>
        <from usec="0" sec="1199163972"/>
        <to usec="0" sec="1199164313"/>
    </anomaly>
    <anomaly type="suspicious" value="0.865421,1.007160,503,0 0 0 1 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="194.51.185.161"/>
        </slice>
        <from usec="0" sec="1199164335"/>
        <to usec="0" sec="1199164411"/>
    </anomaly>
    <anomaly type="suspicious" value="0.841107,0.874167,999,0 0 0 1 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="152.131.22.55" src_port="61364"/>
        </slice>
        <from usec="0" sec="1199163600"/>
        <to usec="0" sec="1199163978"/>
    </anomaly>
    <anomaly type="suspicious" value="0.639118,0.894884,999,1 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="152.131.1.153" dst_port="25"/>
            <filter src_ip="214.134.156.135" dst_ip="152.131.1.153" src_port="25"/>
            <filter src_ip="214.134.156.214" dst_ip="152.131.1.153" src_port="25"/>
        </slice>
        <from usec="0" sec="1199163600"/>
        <to usec="0" sec="1199164413"/>
    </anomaly>
    <anomaly type="suspicious" value="0.696512,0.834724,020,1 0 0 0 0 0 1 1 1 0 0 0,ntscICec">
        <slice>
            <filter src_ip="158.118.77.70"/>
        </slice>
        <from usec="0" sec="1199163735"/>
        <to usec="0" sec="1199163781"/>
    </anomaly>
    <anomaly type="suspicious" value="0.696512,0.834724,020,1 0 0 0 0 0 1 1 1 0 0 0,ntscICec">
        <slice>
            <filter src_ip="200.237.176.69"/>
        </slice>
        <from usec="0" sec="1199163735"/>
        <to usec="0" sec="1199163781"/>
    </anomaly>
    <anomaly type="suspicious" value="0.794231,0.931784,999,0 0 0 1 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="152.131.12.93" dst_port="53"/>
            <filter dst_ip="158.118.169.178" dst_port="53"/>
            <filter dst_ip="152.131.12.93" src_port="53" dst_port="33462"/>
            <filter dst_ip="158.118.169.178" src_port="53" dst_port="65486"/>
        </slice>
        <from usec="0" sec="1199163600"/>
        <to usec="0" sec="1199163916"/>
    </anomaly>
    <anomaly type="suspicious" value="0.639118,0.894884,020,1 0 0 0 0 0 1 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="220.1.130.63"/>
        </slice>
        <from usec="0" sec="1199163648"/>
        <to usec="0" sec="1199164261"/>
    </anomaly>
    <anomaly type="suspicious" value="0.639118,0.894884,010,1 0 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="220.1.128.183" dst_port="135"/>
        </slice>
        <from usec="0" sec="1199164365"/>
        <to usec="0" sec="1199164498"/>
    </anomaly>
    <anomaly type="suspicious" value="0.639118,0.894884,020,1 0 0 0 0 0 1 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="220.1.128.183"/>
        </slice>
        <from usec="0" sec="1199164365"/>
        <to usec="0" sec="1199164498"/>
    </anomaly>
    <anomaly type="suspicious" value="0.601295,0.835469,999,0 0 0 0 0 0 1 1 1 0 0 0,heavy_hitter">
        <slice>
            <filter src_ip="171.27.24.156" dst_ip="222.152.195.184" src_port="3124"/>
        </slice>
        <from usec="0" sec="1199163735"/>
        <to usec="0" sec="1199163781"/>
    </anomaly>
    <anomaly type="suspicious" value="0.601295,0.835469,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="158.118.24.112" src_port="25"/>
            <filter src_ip="158.118.24.112" dst_port="25"/>
            <filter src_ip="158.118.24.112" src_port="47498" dst_port="53"/>
        </slice>
        <from usec="0" sec="1199163735"/>
        <to usec="0" sec="1199163781"/>
    </anomaly>
    <anomaly type="suspicious" value="0.601295,0.835469,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="158.118.130.240" dst_port="25"/>
            <filter src_ip="158.118.130.240" dst_ip="43.52.177.6" dst_port="2703"/>
        </slice>
        <from usec="0" sec="1199163600"/>
        <to usec="0" sec="1199163781"/>
    </anomaly>
    <anomaly type="suspicious" value="0.601295,0.835469,010,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="218.217.121.194" src_port="40715"/>
        </slice>
        <from usec="0" sec="1199163735"/>
        <to usec="0" sec="1199163781"/>
    </anomaly>
    <anomaly type="suspicious" value="0.601295,0.835469,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="152.131.12.32" src_port="32817" dst_port="53"/>
        </slice>
        <from usec="0" sec="1199163735"/>
        <to usec="0" sec="1199163781"/>
    </anomaly>
    <anomaly type="suspicious" value="0.601295,0.835469,020,0 0 0 0 0 0 1 1 1 0 0 0,ntscICec">
        <slice>
            <filter src_ip="214.211.143.255"/>
        </slice>
        <from usec="0" sec="1199163735"/>
        <to usec="0" sec="1199163781"/>
    </anomaly>
    <anomaly type="suspicious" value="0.601295,0.835469,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="152.131.35.145" src_port="65013"/>
        </slice>
        <from usec="0" sec="1199163600"/>
        <to usec="0" sec="1199163781"/>
    </anomaly>
    <anomaly type="suspicious" value="0.601295,0.835469,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="158.118.82.197" src_port="25"/>
            <filter src_ip="158.118.82.197" dst_port="25"/>
            <filter src_ip="158.118.82.197" src_port="32774" dst_port="53"/>
        </slice>
        <from usec="0" sec="1199163735"/>
        <to usec="0" sec="1199163781"/>
    </anomaly>
    <anomaly type="suspicious" value="0.601295,0.835469,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="152.131.12.88" src_port="25"/>
            <filter src_ip="152.131.12.88" dst_port="25"/>
        </slice>
        <from usec="0" sec="1199163600"/>
        <to usec="0" sec="1199163781"/>
    </anomaly>
    <anomaly type="suspicious" value="0.601295,0.835469,020,0 0 0 0 0 0 1 1 1 0 0 0,ttl_error">
        <slice>
            <filter src_ip="80.2.21.116"/>
        </slice>
        <from usec="0" sec="1199163735"/>
        <to usec="0" sec="1199163781"/>
    </anomaly>
    <anomaly type="suspicious" value="0.601295,0.835469,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="171.27.199.119" src_port="7100" dst_port="7100"/>
        </slice>
        <from usec="0" sec="1199163735"/>
        <to usec="0" sec="1199163781"/>
    </anomaly>
    <anomaly type="suspicious" value="0.601295,0.835469,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="158.118.108.199" src_port="25"/>
            <filter src_ip="158.118.108.199" src_port="32773" dst_port="53"/>
        </slice>
        <from usec="0" sec="1199163735"/>
        <to usec="0" sec="1199163781"/>
    </anomaly>
    <anomaly type="suspicious" value="0.601295,0.835469,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="158.118.169.178" src_port="53"/>
            <filter src_ip="158.118.169.178" src_port="65486" dst_port="53"/>
        </slice>
        <from usec="0" sec="1199163735"/>
        <to usec="0" sec="1199163781"/>
    </anomaly>
    <anomaly type="suspicious" value="0.601295,0.835469,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmpla">
        <slice>
            <filter src_ip="53.151.155.33" dst_ip="194.127.60.83" dst_port="53"/>
            <filter src_ip="53.151.155.33" dst_ip="194.127.60.95" dst_port="53"/>
        </slice>
        <from usec="0" sec="1199163735"/>
        <to usec="0" sec="1199163781"/>
    </anomaly>
    <anomaly type="suspicious" value="0.601295,0.835469,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmpla">
        <slice>
            <filter src_ip="215.81.239.54" dst_ip="194.127.60.95" dst_port="53"/>
            <filter src_ip="215.81.239.54" dst_ip="194.127.60.83" dst_port="53"/>
        </slice>
        <from usec="0" sec="1199163735"/>
        <to usec="0" sec="1199163781"/>
    </anomaly>
    <anomaly type="suspicious" value="0.601295,0.835469,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="158.118.29.78" src_port="51273" dst_port="53"/>
        </slice>
        <from usec="0" sec="1199163735"/>
        <to usec="0" sec="1199163781"/>
    </anomaly>
    <anomaly type="suspicious" value="0.601295,0.835469,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="158.118.112.11" src_port="58568" dst_port="53"/>
        </slice>
        <from usec="0" sec="1199163735"/>
        <to usec="0" sec="1199163781"/>
    </anomaly>
    <anomaly type="suspicious" value="0.601295,0.835469,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmpla">
        <slice>
            <filter src_ip="215.81.239.58" dst_ip="194.127.60.95" dst_port="53"/>
            <filter src_ip="215.81.239.58" dst_ip="194.127.60.83" dst_port="53"/>
        </slice>
        <from usec="0" sec="1199163735"/>
        <to usec="0" sec="1199163781"/>
    </anomaly>
    <anomaly type="suspicious" value="0.601295,0.835469,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmpla">
        <slice>
            <filter src_ip="215.85.246.227" dst_ip="194.127.60.95" dst_port="53"/>
            <filter src_ip="215.85.246.227" dst_ip="194.127.60.83" dst_port="53"/>
        </slice>
        <from usec="0" sec="1199163735"/>
        <to usec="0" sec="1199163781"/>
    </anomaly>
    <anomaly type="suspicious" value="0.601295,0.835469,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmpla">
        <slice>
            <filter src_ip="215.81.238.134" dst_ip="194.127.60.95" dst_port="53"/>
            <filter src_ip="215.81.238.134" dst_ip="194.127.60.83" dst_port="53"/>
        </slice>
        <from usec="0" sec="1199163735"/>
        <to usec="0" sec="1199163781"/>
    </anomaly>
    <anomaly type="suspicious" value="0.601295,0.835469,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmpla">
        <slice>
            <filter src_ip="215.81.238.132" dst_ip="194.127.60.95" dst_port="53"/>
            <filter src_ip="215.81.238.132" dst_ip="194.127.60.83" dst_port="53"/>
        </slice>
        <from usec="0" sec="1199163735"/>
        <to usec="0" sec="1199163781"/>
    </anomaly>
    <anomaly type="suspicious" value="0.601295,0.835469,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmpla">
        <slice>
            <filter src_ip="215.85.246.224" dst_ip="194.127.60.95" dst_port="53"/>
            <filter src_ip="215.85.246.224" dst_ip="194.127.60.83" dst_port="53"/>
        </slice>
        <from usec="0" sec="1199163735"/>
        <to usec="0" sec="1199163781"/>
    </anomaly>
    <anomaly type="suspicious" value="0.601295,0.835469,010,0 0 0 0 0 0 1 1 1 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="158.118.22.158" dst_port="25"/>
        </slice>
        <from usec="0" sec="1199163600"/>
        <to usec="0" sec="1199163781"/>
    </anomaly>
    <anomaly type="suspicious" value="0.601295,0.835469,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmpla">
        <slice>
            <filter src_ip="215.85.246.252" dst_ip="194.127.60.95" dst_port="53"/>
            <filter src_ip="215.85.246.252" dst_ip="194.127.60.83" dst_port="53"/>
        </slice>
        <from usec="0" sec="1199163735"/>
        <to usec="0" sec="1199163781"/>
    </anomaly>
    <anomaly type="suspicious" value="0.601295,0.835469,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmpla">
        <slice>
            <filter src_ip="42.236.213.191" dst_ip="194.127.60.95" dst_port="53"/>
            <filter src_ip="42.236.213.191" dst_ip="194.127.60.83" dst_port="53"/>
        </slice>
        <from usec="0" sec="1199163735"/>
        <to usec="0" sec="1199163781"/>
    </anomaly>
    <anomaly type="suspicious" value="0.601295,0.835469,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="201.107.240.124" src_port="53"/>
        </slice>
        <from usec="0" sec="1199163600"/>
        <to usec="0" sec="1199163781"/>
    </anomaly>
    <anomaly type="suspicious" value="0.841107,0.874167,999,0 0 0 1 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="201.107.240.121" src_port="53"/>
        </slice>
        <from usec="0" sec="1199163600"/>
        <to usec="0" sec="1199164338"/>
    </anomaly>
    <anomaly type="suspicious" value="0.601295,0.835469,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmpla">
        <slice>
            <filter src_ip="215.81.239.33" dst_ip="194.127.60.95" dst_port="53"/>
            <filter src_ip="215.81.239.33" dst_ip="194.127.60.83" dst_port="53"/>
        </slice>
        <from usec="0" sec="1199163735"/>
        <to usec="0" sec="1199163781"/>
    </anomaly>
    <anomaly type="suspicious" value="0.601295,0.835469,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="158.118.95.1" dst_port="25"/>
        </slice>
        <from usec="0" sec="1199163735"/>
        <to usec="0" sec="1199163781"/>
    </anomaly>
    <anomaly type="suspicious" value="0.601295,0.835469,010,0 0 0 0 0 0 1 1 1 0 0 0,sptpDoSSYN">
        <slice>
            <filter src_ip="158.118.95.1" dst_ip="48.115.76.133" dst_port="113"/>
        </slice>
        <from usec="0" sec="1199163735"/>
        <to usec="0" sec="1199163781"/>
    </anomaly>
    <anomaly type="suspicious" value="0.601295,0.835469,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="194.127.56.40" src_port="53"/>
        </slice>
        <from usec="0" sec="1199163735"/>
        <to usec="0" sec="1199163781"/>
    </anomaly>
    <anomaly type="suspicious" value="0.601295,0.835469,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="158.118.236.152" dst_port="25"/>
        </slice>
        <from usec="0" sec="1199163735"/>
        <to usec="0" sec="1199163781"/>
    </anomaly>
    <anomaly type="suspicious" value="0.601295,0.835469,999,0 0 0 0 0 0 1 1 1 0 0 0,alphfl">
        <slice>
            <filter src_ip="152.131.1.153" dst_ip="36.191.79.255" dst_port="25"/>
        </slice>
        <from usec="0" sec="1199163735"/>
        <to usec="0" sec="1199163781"/>
    </anomaly>
    <anomaly type="suspicious" value="0.601295,0.835469,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="152.131.23.31" src_port="22801"/>
        </slice>
        <from usec="0" sec="1199163735"/>
        <to usec="0" sec="1199164411"/>
    </anomaly>
    <anomaly type="suspicious" value="0.601295,0.835469,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="194.168.248.16" dst_port="25"/>
        </slice>
        <from usec="0" sec="1199163600"/>
        <to usec="0" sec="1199163781"/>
    </anomaly>
    <anomaly type="suspicious" value="0.601295,0.835469,999,0 0 0 0 0 0 1 1 1 0 0 0,alphfl">
        <slice>
            <filter src_ip="171.27.24.157" dst_ip="34.182.175.158" src_port="3127"/>
        </slice>
        <from usec="0" sec="1199163735"/>
        <to usec="0" sec="1199163781"/>
    </anomaly>
    <anomaly type="suspicious" value="0.601295,0.835469,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="152.131.12.93" src_port="53"/>
            <filter src_ip="152.131.12.93" src_port="33462" dst_port="53"/>
        </slice>
        <from usec="0" sec="1199163600"/>
        <to usec="0" sec="1199163781"/>
    </anomaly>
    <anomaly type="suspicious" value="0.601295,0.835469,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmpla">
        <slice>
            <filter src_ip="100.131.183.155" dst_port="53"/>
        </slice>
        <from usec="0" sec="1199163735"/>
        <to usec="0" sec="1199163781"/>
    </anomaly>
    <anomaly type="suspicious" value="0.696512,0.834724,010,1 0 0 0 0 0 1 1 1 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="220.1.130.63" dst_port="135"/>
        </slice>
        <from usec="0" sec="1199163600"/>
        <to usec="0" sec="1199164278"/>
    </anomaly>
    <anomaly type="suspicious" value="0.601295,0.835469,999,0 0 0 0 0 0 1 1 1 0 0 0,mptpla">
        <slice>
            <filter src_ip="152.131.156.83" dst_ip="80.19.7.5" dst_port="53"/>
            <filter src_ip="152.131.156.110" dst_ip="80.19.7.5" dst_port="53"/>
        </slice>
        <from usec="0" sec="1199163735"/>
        <to usec="0" sec="1199164276"/>
    </anomaly>
    <anomaly type="suspicious" value="0.601295,0.835469,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="152.131.156.84" src_port="53"/>
        </slice>
        <from usec="0" sec="1199163735"/>
        <to usec="0" sec="1199163781"/>
    </anomaly>
    <anomaly type="suspicious" value="0.601295,0.835469,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="158.118.243.63" dst_port="25"/>
        </slice>
        <from usec="0" sec="1199163735"/>
        <to usec="0" sec="1199163781"/>
    </anomaly>
    <anomaly type="suspicious" value="0.601295,0.835469,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmpla">
        <slice>
            <filter src_ip="50.33.79.27" dst_ip="194.127.60.95" dst_port="53"/>
            <filter src_ip="50.33.79.27" dst_ip="194.127.60.83" dst_port="53"/>
        </slice>
        <from usec="0" sec="1199163735"/>
        <to usec="0" sec="1199163781"/>
    </anomaly>
    <anomaly type="suspicious" value="0.601295,0.835469,999,0 0 0 0 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_ip="171.27.196.159" src_port="20129" dst_port="20129"/>
            <filter src_ip="194.168.195.29" src_port="20129" dst_port="20129"/>
            <filter dst_ip="194.168.195.29" src_port="20129" dst_port="20129"/>
        </slice>
        <from usec="0" sec="1199163735"/>
        <to usec="0" sec="1199163781"/>
    </anomaly>
    <anomaly type="suspicious" value="0.601295,0.835469,999,0 0 0 0 0 0 1 1 1 0 0 0,alphfl">
        <slice>
            <filter src_ip="215.85.244.192" dst_ip="194.127.60.95" dst_port="53"/>
        </slice>
        <from usec="0" sec="1199163735"/>
        <to usec="0" sec="1199163781"/>
    </anomaly>
    <anomaly type="suspicious" value="0.601295,0.835469,999,0 0 0 0 0 0 1 1 1 0 0 0,alphfl">
        <slice>
            <filter src_ip="215.81.239.52" dst_ip="194.127.60.95" dst_port="53"/>
        </slice>
        <from usec="0" sec="1199163735"/>
        <to usec="0" sec="1199163781"/>
    </anomaly>
    <anomaly type="suspicious" value="0.601295,0.835469,999,0 0 0 0 0 0 1 1 1 0 0 0,alphfl">
        <slice>
            <filter src_ip="215.85.244.201" dst_ip="194.127.60.83" dst_port="53"/>
        </slice>
        <from usec="0" sec="1199163600"/>
        <to usec="0" sec="1199163781"/>
    </anomaly>
    <anomaly type="suspicious" value="0.601295,0.835469,999,0 0 0 0 0 0 1 1 1 0 0 0,alphfl">
        <slice>
            <filter src_ip="215.85.244.201" dst_ip="194.127.60.95" dst_port="53"/>
        </slice>
        <from usec="0" sec="1199163735"/>
        <to usec="0" sec="1199163781"/>
    </anomaly>
    <anomaly type="suspicious" value="0.601295,0.835469,999,0 0 0 0 0 0 1 1 1 0 0 0,alphfl">
        <slice>
            <filter src_ip="215.81.239.56" dst_ip="194.127.60.95" dst_port="53"/>
        </slice>
        <from usec="0" sec="1199163735"/>
        <to usec="0" sec="1199163781"/>
    </anomaly>
    <anomaly type="suspicious" value="0.601295,0.835469,999,0 0 0 0 0 0 1 1 1 0 0 0,alphfl">
        <slice>
            <filter src_ip="215.85.244.202" dst_ip="194.127.60.95" dst_port="53"/>
        </slice>
        <from usec="0" sec="1199163735"/>
        <to usec="0" sec="1199163781"/>
    </anomaly>
    <anomaly type="suspicious" value="0.601295,0.835469,999,0 0 0 0 0 0 1 1 1 0 0 0,alphfl">
        <slice>
            <filter src_ip="220.199.115.48" dst_ip="194.127.60.95" dst_port="53"/>
        </slice>
        <from usec="0" sec="1199163735"/>
        <to usec="0" sec="1199163781"/>
    </anomaly>
    <anomaly type="suspicious" value="0.601295,0.835469,999,0 0 0 0 0 0 1 1 1 0 0 0,alphfl">
        <slice>
            <filter src_ip="215.85.246.226" dst_ip="194.127.60.95" dst_port="53"/>
        </slice>
        <from usec="0" sec="1199163735"/>
        <to usec="0" sec="1199163781"/>
    </anomaly>
    <anomaly type="suspicious" value="0.601295,0.835469,999,0 0 0 0 0 0 1 1 1 0 0 0,alphfl">
        <slice>
            <filter src_ip="215.85.246.225" dst_ip="194.127.60.83" dst_port="53"/>
        </slice>
        <from usec="0" sec="1199163735"/>
        <to usec="0" sec="1199163781"/>
    </anomaly>
    <anomaly type="suspicious" value="0.601295,0.835469,999,0 0 0 0 0 0 1 1 1 0 0 0,alphfl">
        <slice>
            <filter src_ip="215.85.246.225" dst_ip="194.127.60.95" dst_port="53"/>
        </slice>
        <from usec="0" sec="1199163735"/>
        <to usec="0" sec="1199163781"/>
    </anomaly>
    <anomaly type="suspicious" value="0.601295,0.835469,999,0 0 0 0 0 0 1 1 1 0 0 0,alphfl">
        <slice>
            <filter src_ip="215.81.237.6" dst_ip="194.127.60.95" dst_port="53"/>
        </slice>
        <from usec="0" sec="1199163735"/>
        <to usec="0" sec="1199163781"/>
    </anomaly>
    <anomaly type="suspicious" value="0.601295,0.835469,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="222.158.29.133" src_port="3824" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1199163735"/>
        <to usec="0" sec="1199163781"/>
    </anomaly>
    <anomaly type="suspicious" value="0.601295,0.835469,999,0 0 0 0 0 0 1 1 1 0 0 0,alphfl">
        <slice>
            <filter src_ip="215.85.246.254" dst_ip="194.127.60.95" dst_port="53"/>
        </slice>
        <from usec="0" sec="1199163735"/>
        <to usec="0" sec="1199163781"/>
    </anomaly>
    <anomaly type="suspicious" value="0.601295,0.835469,999,0 0 0 0 0 0 1 1 1 0 0 0,alphfl">
        <slice>
            <filter src_ip="215.85.244.213" dst_ip="194.127.60.95" dst_port="53"/>
        </slice>
        <from usec="0" sec="1199163735"/>
        <to usec="0" sec="1199163781"/>
    </anomaly>
    <anomaly type="suspicious" value="0.601295,0.835469,999,0 0 0 0 0 0 1 1 1 0 0 0,alphfl">
        <slice>
            <filter src_ip="50.49.136.198" dst_ip="194.127.60.95" dst_port="53"/>
        </slice>
        <from usec="0" sec="1199163735"/>
        <to usec="0" sec="1199163781"/>
    </anomaly>
    <anomaly type="suspicious" value="0.601295,0.835469,999,0 0 0 0 0 0 1 1 1 0 0 0,alphfl">
        <slice>
            <filter src_ip="50.33.79.137" dst_ip="194.127.60.95" dst_port="53"/>
        </slice>
        <from usec="0" sec="1199163735"/>
        <to usec="0" sec="1199163781"/>
    </anomaly>
    <anomaly type="suspicious" value="0.601295,0.835469,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="81.164.37.24" src_port="2795" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1199163735"/>
        <to usec="0" sec="1199163781"/>
    </anomaly>
    <anomaly type="suspicious" value="0.601295,0.835469,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="4.20.218.83" src_port="1316" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1199163735"/>
        <to usec="0" sec="1199163781"/>
    </anomaly>
    <anomaly type="suspicious" value="0.601295,0.835469,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="84.16.229.36" src_port="2187" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1199163735"/>
        <to usec="0" sec="1199163781"/>
    </anomaly>
    <anomaly type="suspicious" value="0.601295,0.835469,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="148.137.212.180" src_port="4470" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1199163735"/>
        <to usec="0" sec="1199163781"/>
    </anomaly>
    <anomaly type="suspicious" value="0.601295,0.835469,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="194.25.90.231" src_port="1063" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1199163735"/>
        <to usec="0" sec="1199163781"/>
    </anomaly>
    <anomaly type="suspicious" value="0.601295,0.835469,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="80.44.185.157" src_port="2324" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1199163735"/>
        <to usec="0" sec="1199163781"/>
    </anomaly>
    <anomaly type="suspicious" value="0.601295,0.835469,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="219.109.209.173" src_port="1686" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1199163735"/>
        <to usec="0" sec="1199163781"/>
    </anomaly>
    <anomaly type="suspicious" value="0.601295,0.835469,999,0 0 0 0 0 0 1 1 1 0 0 0,salphfl">
        <slice>
            <filter src_ip="50.190.150.252" dst_ip="194.127.60.95" dst_port="53"/>
        </slice>
        <from usec="0" sec="1199163735"/>
        <to usec="0" sec="1199163781"/>
    </anomaly>
    <anomaly type="suspicious" value="0.601295,0.835469,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="195.21.230.187" src_port="1035" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1199163735"/>
        <to usec="0" sec="1199163781"/>
    </anomaly>
    <anomaly type="suspicious" value="0.601295,0.835469,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="223.231.120.98" src_port="4376" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1199163735"/>
        <to usec="0" sec="1199163781"/>
    </anomaly>
    <anomaly type="suspicious" value="0.601295,0.835469,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="223.171.101.206" src_port="4608" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1199163735"/>
        <to usec="0" sec="1199163781"/>
    </anomaly>
    <anomaly type="suspicious" value="0.601295,0.835469,999,0 0 0 0 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_ip="195.195.168.41" dst_ip="198.79.219.218"/>
            <filter src_ip="195.195.168.41" src_port="3124"/>
            <filter dst_ip="198.79.219.218" src_port="3124"/>
            <filter src_ip="195.195.168.41"/>
        </slice>
        <from usec="0" sec="1199163600"/>
        <to usec="0" sec="1199164411"/>
    </anomaly>
    <anomaly type="suspicious" value="0.601295,0.835469,999,0 0 0 0 0 0 1 1 1 0 0 0,alphfl">
        <slice>
            <filter src_ip="32.140.32.140" dst_ip="194.127.60.83" dst_port="53"/>
        </slice>
        <from usec="0" sec="1199163600"/>
        <to usec="0" sec="1199163916"/>
    </anomaly>
    <anomaly type="suspicious" value="0.601295,0.835469,999,0 0 0 0 0 0 1 1 1 0 0 0,mptpla">
        <slice>
            <filter src_ip="215.81.239.56" dst_ip="194.127.60.83" dst_port="53"/>
            <filter src_ip="215.85.244.213" dst_ip="194.127.60.83" dst_port="53"/>
            <filter src_ip="215.81.237.6" dst_ip="194.127.60.83" dst_port="53"/>
        </slice>
        <from usec="0" sec="1199163600"/>
        <to usec="0" sec="1199163781"/>
    </anomaly>
</admd:annotation>
