<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="anomalous" value="1.481720,1.363480,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="213.11.137.193" src_port="43476" dst_port="1027"/>
            <filter src_ip="213.11.137.193" src_port="43476" dst_port="1026"/>
        </slice>
        <from usec="0" sec="1201929041"/>
        <to usec="0" sec="1201929046"/>
    </anomaly>
    <anomaly type="anomalous" value="2.127750,1.710010,503,1 1 1 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="138.43.105.124" dst_ip="18.166.18.102" dst_port="80"/>
        </slice>
        <from usec="0" sec="1201928401"/>
        <to usec="0" sec="1201929229"/>
    </anomaly>
    <anomaly type="anomalous" value="1.157270,1.134820,503,1 1 0 1 1 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="194.245.37.91" dst_ip="93.89.67.14"/>
            <filter src_ip="194.245.37.91" src_port="80"/>
            <filter src_ip="194.245.37.91" src_port="21"/>
            <filter dst_ip="93.89.67.14" src_port="80"/>
        </slice>
        <from usec="0" sec="1201928401"/>
        <to usec="0" sec="1201929233"/>
    </anomaly>
    <anomaly type="anomalous" value="4.512290,3.775060,010,1 1 1 1 1 1 1 1 1 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="16.8.33.56" src_port="6000" dst_port="135"/>
        </slice>
        <from usec="0" sec="1201928941"/>
        <to usec="0" sec="1201928987"/>
    </anomaly>
    <anomaly type="anomalous" value="1.481720,1.363480,503,1 1 1 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="195.178.138.31" dst_port="80"/>
        </slice>
        <from usec="0" sec="1201928848"/>
        <to usec="0" sec="1201929255"/>
    </anomaly>
    <anomaly type="anomalous" value="1.481720,1.363480,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="213.167.80.0" src_port="38659" dst_port="1026"/>
            <filter src_ip="213.167.80.0" src_port="38659" dst_port="1027"/>
        </slice>
        <from usec="0" sec="1201929227"/>
        <to usec="0" sec="1201929232"/>
    </anomaly>
    <anomaly type="anomalous" value="1.481720,1.363480,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="44.124.44.51" src_port="6000" dst_port="135"/>
        </slice>
        <from usec="0" sec="1201929210"/>
        <to usec="0" sec="1201929212"/>
    </anomaly>
    <anomaly type="anomalous" value="1.481720,1.363480,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="213.10.233.144" src_port="44899" dst_port="1026"/>
            <filter src_ip="213.10.233.144" src_port="44899" dst_port="1027"/>
        </slice>
        <from usec="0" sec="1201929245"/>
        <to usec="0" sec="1201929250"/>
    </anomaly>
    <anomaly type="anomalous" value="1.481720,1.363480,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="210.10.213.0" src_port="57599" dst_port="1027"/>
        </slice>
        <from usec="0" sec="1201928401"/>
        <to usec="0" sec="1201928522"/>
    </anomaly>
    <anomaly type="anomalous" value="1.199810,1.195910,010,1 1 0 0 0 0 1 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="212.78.201.200" dst_port="139"/>
            <filter src_ip="212.78.201.200" dst_port="445"/>
        </slice>
        <from usec="0" sec="1201928986"/>
        <to usec="0" sec="1201929051"/>
    </anomaly>
    <anomaly type="anomalous" value="1.481720,1.363480,999,1 1 1 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="138.201.162.223" dst_ip="25.174.104.23" src_port="51300" dst_port="993"/>
            <filter src_ip="138.201.162.223" dst_ip="18.208.92.158" src_port="51430" dst_port="993"/>
        </slice>
        <from usec="0" sec="1201928538"/>
        <to usec="0" sec="1201928543"/>
    </anomaly>
    <anomaly type="anomalous" value="1.481720,1.363480,503,1 1 1 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="91.220.90.88" dst_ip="141.54.41.100" src_port="80"/>
        </slice>
        <from usec="0" sec="1201928870"/>
        <to usec="0" sec="1201929156"/>
    </anomaly>
    <anomaly type="anomalous" value="1.629150,1.485170,999,1 0 0 1 1 1 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="169.16.18.68" dst_port="7134"/>
            <filter dst_ip="169.16.18.68" dst_port="7100"/>
        </slice>
        <from usec="0" sec="1201928401"/>
        <to usec="0" sec="1201929229"/>
    </anomaly>
    <anomaly type="anomalous" value="1.600040,1.504310,503,0 0 0 1 1 1 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="45.188.62.80" dst_ip="138.43.64.103" src_port="80" dst_port="1918"/>
            <filter src_ip="45.188.62.80" dst_ip="169.16.87.93" src_port="80" dst_port="53415"/>
        </slice>
        <from usec="0" sec="1201928401"/>
        <to usec="0" sec="1201928597"/>
    </anomaly>
    <anomaly type="anomalous" value="1.157270,1.134820,503,1 1 0 1 1 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="3.2.91.218" dst_ip="194.245.37.91" dst_port="80"/>
        </slice>
        <from usec="0" sec="1201928401"/>
        <to usec="0" sec="1201929270"/>
    </anomaly>
    <anomaly type="anomalous" value="1.600040,1.504310,999,0 0 0 1 1 1 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="158.142.31.75" dst_ip="18.208.66.19"/>
            <filter src_ip="158.142.31.75" src_port="80"/>
            <filter src_ip="158.142.83.195" dst_ip="18.208.66.19" src_port="80"/>
        </slice>
        <from usec="0" sec="1201928401"/>
        <to usec="0" sec="1201928952"/>
    </anomaly>
    <anomaly type="anomalous" value="1.629150,1.485170,503,1 0 0 1 1 1 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="90.250.109.25" src_port="80"/>
            <filter src_ip="45.188.63.219" src_port="80"/>
            <filter dst_ip="141.54.146.49" src_port="80"/>
        </slice>
        <from usec="0" sec="1201928401"/>
        <to usec="0" sec="1201928951"/>
    </anomaly>
    <anomaly type="anomalous" value="1.654110,1.377760,503,1 1 1 1 1 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="169.16.17.104" dst_port="80"/>
            <filter dst_ip="211.219.64.254" dst_port="80"/>
            <filter src_ip="141.54.184.129" dst_ip="211.219.64.20" dst_port="80"/>
        </slice>
        <from usec="0" sec="1201928401"/>
        <to usec="0" sec="1201929049"/>
    </anomaly>
    <anomaly type="anomalous" value="1.159600,1.145780,999,1 1 0 1 0 0 1 0 0 0 0 0,mptmp">
        <slice>
            <filter dst_port="53"/>
            <filter src_ip="195.187.207.140" dst_port="80"/>
        </slice>
        <from usec="0" sec="1201928401"/>
        <to usec="0" sec="1201929225"/>
    </anomaly>
    <anomaly type="anomalous" value="1.157270,1.134820,503,1 1 0 1 1 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="169.16.175.88" dst_port="80"/>
        </slice>
        <from usec="0" sec="1201928489"/>
        <to usec="0" sec="1201929024"/>
    </anomaly>
    <anomaly type="anomalous" value="1.655740,1.386800,020,1 1 1 1 0 0 1 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="194.245.42.54"/>
        </slice>
        <from usec="0" sec="1201928401"/>
        <to usec="0" sec="1201929228"/>
    </anomaly>
    <anomaly type="anomalous" value="1.449350,1.319730,502,1 1 1 1 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="91.135.190.133" src_port="22"/>
        </slice>
        <from usec="0" sec="1201928409"/>
        <to usec="0" sec="1201929229"/>
    </anomaly>
    <anomaly type="anomalous" value="1.629150,1.485170,503,1 0 0 1 1 1 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="45.188.63.168" dst_ip="141.54.101.203" src_port="80"/>
            <filter src_ip="45.188.63.168" dst_ip="141.54.59.140" src_port="80"/>
        </slice>
        <from usec="0" sec="1201928403"/>
        <to usec="0" sec="1201928865"/>
    </anomaly>
    <anomaly type="anomalous" value="1.226270,1.166750,503,1 0 0 1 1 0 1 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="169.16.175.88" src_port="80"/>
        </slice>
        <from usec="0" sec="1201928403"/>
        <to usec="0" sec="1201929005"/>
    </anomaly>
    <anomaly type="anomalous" value="1.600040,1.504310,503,0 0 0 1 1 1 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="169.16.175.119" dst_ip="42.25.197.135" src_port="80"/>
        </slice>
        <from usec="0" sec="1201928412"/>
        <to usec="0" sec="1201929204"/>
    </anomaly>
    <anomaly type="anomalous" value="2.273360,1.762290,020,1 1 1 1 1 1 1 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="93.138.163.113"/>
        </slice>
        <from usec="0" sec="1201928401"/>
        <to usec="0" sec="1201929226"/>
    </anomaly>
    <anomaly type="anomalous" value="2.588660,1.978500,999,1 1 1 1 1 1 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="195.17.162.35" dst_port="53"/>
            <filter dst_ip="200.126.213.66" dst_port="53"/>
        </slice>
        <from usec="0" sec="1201928401"/>
        <to usec="0" sec="1201929302"/>
    </anomaly>
    <anomaly type="anomalous" value="1.629150,1.485170,503,1 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="70.55.9.56" dst_ip="195.178.138.31" src_port="80"/>
        </slice>
        <from usec="0" sec="1201928615"/>
        <to usec="0" sec="1201929049"/>
    </anomaly>
    <anomaly type="anomalous" value="1.600040,1.504310,503,0 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="1.71.208.245" dst_ip="138.43.105.124" src_port="80"/>
        </slice>
        <from usec="0" sec="1201928401"/>
        <to usec="0" sec="1201929229"/>
    </anomaly>
    <anomaly type="anomalous" value="1.600040,1.504310,503,0 0 0 1 1 1 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="29.132.179.236" dst_ip="141.54.121.151" src_port="80"/>
        </slice>
        <from usec="0" sec="1201928402"/>
        <to usec="0" sec="1201929123"/>
    </anomaly>
    <anomaly type="anomalous" value="1.226270,1.166750,999,1 0 0 1 1 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="138.43.28.134" src_port="53"/>
            <filter dst_ip="138.43.161.11" src_port="53"/>
        </slice>
        <from usec="0" sec="1201928401"/>
        <to usec="0" sec="1201929049"/>
    </anomaly>
    <anomaly type="anomalous" value="1.789130,1.563480,999,0 0 0 1 1 1 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="170.50.124.219" dst_port="6388"/>
            <filter dst_ip="170.50.124.219" dst_port="9132"/>
        </slice>
        <from usec="0" sec="1201928401"/>
        <to usec="0" sec="1201929176"/>
    </anomaly>
    <anomaly type="anomalous" value="1.655740,1.386800,999,1 1 1 1 0 0 1 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="141.54.82.239" src_port="25"/>
            <filter src_ip="141.54.82.239" dst_port="25"/>
        </slice>
        <from usec="0" sec="1201928402"/>
        <to usec="0" sec="1201929137"/>
    </anomaly>
    <anomaly type="anomalous" value="2.273360,1.762290,502,1 1 1 1 1 1 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="91.135.190.133" dst_port="22"/>
        </slice>
        <from usec="0" sec="1201928406"/>
        <to usec="0" sec="1201929302"/>
    </anomaly>
    <anomaly type="anomalous" value="4.309240,3.636640,999,1 1 1 1 1 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter dst_ip="195.17.160.112" dst_port="53"/>
            <filter dst_ip="195.17.160.120" dst_port="53"/>
        </slice>
        <from usec="0" sec="1201928401"/>
        <to usec="0" sec="1201929302"/>
    </anomaly>
    <anomaly type="anomalous" value="1.874340,1.509350,999,1 1 0 1 1 0 1 1 0 0 0 0,mptmp">
        <slice>
            <filter dst_ip="194.245.35.28"/>
            <filter dst_ip="194.245.40.63"/>
        </slice>
        <from usec="0" sec="1201928401"/>
        <to usec="0" sec="1201929302"/>
    </anomaly>
    <anomaly type="anomalous" value="1.549910,1.479260,503,0 0 0 0 0 0 1 1 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="141.54.120.12" dst_ip="18.166.18.45" dst_port="80"/>
        </slice>
        <from usec="0" sec="1201928401"/>
        <to usec="0" sec="1201928447"/>
    </anomaly>
    <anomaly type="anomalous" value="1.518990,1.439030,999,0 0 0 1 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="169.16.175.11" dst_port="3128"/>
            <filter dst_ip="169.16.175.11" dst_port="3127"/>
        </slice>
        <from usec="0" sec="1201928401"/>
        <to usec="0" sec="1201928779"/>
    </anomaly>
    <anomaly type="anomalous" value="1.549910,1.479260,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="210.111.107.139" src_port="1036" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1201928941"/>
        <to usec="0" sec="1201928987"/>
    </anomaly>
    <anomaly type="anomalous" value="1.549910,1.479260,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="194.56.58.12" src_port="1055" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1201928941"/>
        <to usec="0" sec="1201928987"/>
    </anomaly>
    <anomaly type="anomalous" value="1.549910,1.479260,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="195.96.149.109" src_port="1096" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1201928941"/>
        <to usec="0" sec="1201928987"/>
    </anomaly>
    <anomaly type="anomalous" value="1.549910,1.479260,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="92.237.85.127" src_port="1163" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1201928941"/>
        <to usec="0" sec="1201928987"/>
    </anomaly>
    <anomaly type="anomalous" value="1.549910,1.479260,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="210.118.14.24" src_port="1591" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1201928941"/>
        <to usec="0" sec="1201928987"/>
    </anomaly>
    <anomaly type="anomalous" value="1.549910,1.479260,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="128.38.97.180" src_port="1676" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1201928941"/>
        <to usec="0" sec="1201928987"/>
    </anomaly>
    <anomaly type="anomalous" value="1.549910,1.479260,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="210.12.123.68" src_port="2534" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1201928941"/>
        <to usec="0" sec="1201928987"/>
    </anomaly>
    <anomaly type="anomalous" value="1.549910,1.479260,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="90.146.195.175" src_port="2885" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1201928941"/>
        <to usec="0" sec="1201928987"/>
    </anomaly>
    <anomaly type="anomalous" value="1.549910,1.479260,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="3.97.214.62" src_port="3104" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1201928941"/>
        <to usec="0" sec="1201928987"/>
    </anomaly>
    <anomaly type="anomalous" value="1.549910,1.479260,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="92.4.20.159" src_port="4090" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1201928941"/>
        <to usec="0" sec="1201928987"/>
    </anomaly>
    <anomaly type="anomalous" value="1.549910,1.479260,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="214.69.192.115" src_port="4110" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1201928941"/>
        <to usec="0" sec="1201928987"/>
    </anomaly>
    <anomaly type="suspicious" value="0.893702,1.117450,503,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="141.54.243.82" dst_ip="210.38.53.194" dst_port="80"/>
        </slice>
        <from usec="0" sec="1201928856"/>
        <to usec="0" sec="1201929001"/>
    </anomaly>
    <anomaly type="suspicious" value="0.838935,1.063620,503,1 1 0 1 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="141.54.146.8" dst_ip="217.12.182.65" dst_port="80"/>
            <filter src_ip="141.54.146.8" dst_ip="29.132.179.149" dst_port="80"/>
        </slice>
        <from usec="0" sec="1201928401"/>
        <to usec="0" sec="1201929289"/>
    </anomaly>
    <anomaly type="suspicious" value="0.893702,1.117450,503,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="193.81.123.219" dst_ip="138.43.114.81" src_port="62469" dst_port="80"/>
        </slice>
        <from usec="0" sec="1201928882"/>
        <to usec="0" sec="1201928896"/>
    </anomaly>
    <anomaly type="suspicious" value="0.838935,1.063620,503,1 1 0 1 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="169.16.17.160" dst_ip="216.172.156.229" src_port="2347" dst_port="80"/>
            <filter src_ip="169.16.17.160" dst_ip="116.234.10.204" src_port="2423" dst_port="80"/>
        </slice>
        <from usec="0" sec="1201928401"/>
        <to usec="0" sec="1201929039"/>
    </anomaly>
    <anomaly type="suspicious" value="0.893702,1.117450,503,1 1 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="169.16.175.2" dst_port="80"/>
        </slice>
        <from usec="0" sec="1201928403"/>
        <to usec="0" sec="1201928962"/>
    </anomaly>
    <anomaly type="suspicious" value="0.893702,1.117450,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="17.155.98.133" dst_ip="169.16.17.119" src_port="80" dst_port="1663"/>
        </slice>
        <from usec="0" sec="1201928852"/>
        <to usec="0" sec="1201928899"/>
    </anomaly>
    <anomaly type="suspicious" value="0.893702,1.117450,503,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="169.16.247.145" dst_ip="22.201.208.108" src_port="1626" dst_port="80"/>
            <filter src_ip="169.16.247.145" dst_ip="22.201.208.108" src_port="1625" dst_port="80"/>
        </slice>
        <from usec="0" sec="1201928893"/>
        <to usec="0" sec="1201928959"/>
    </anomaly>
    <anomaly type="suspicious" value="0.893702,1.117450,503,1 1 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="141.54.118.59" dst_ip="221.4.208.82" dst_port="80"/>
            <filter src_ip="141.54.118.59" dst_ip="221.4.208.93" dst_port="80"/>
        </slice>
        <from usec="0" sec="1201928651"/>
        <to usec="0" sec="1201928871"/>
    </anomaly>
    <anomaly type="suspicious" value="0.893702,1.117450,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="27.210.245.87" dst_ip="141.54.37.53" src_port="80" dst_port="1234"/>
            <filter src_ip="27.210.245.87" dst_ip="141.54.37.53" src_port="80" dst_port="1233"/>
        </slice>
        <from usec="0" sec="1201928975"/>
        <to usec="0" sec="1201929001"/>
    </anomaly>
    <anomaly type="suspicious" value="0.893702,1.117450,503,1 1 0 0 0 0 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="169.16.16.106" dst_ip="208.74.82.243" dst_port="80"/>
        </slice>
        <from usec="0" sec="1201928519"/>
        <to usec="0" sec="1201929017"/>
    </anomaly>
    <anomaly type="suspicious" value="0.893702,1.117450,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="141.54.32.2" dst_ip="70.39.165.162" dst_port="80"/>
        </slice>
        <from usec="0" sec="1201928976"/>
        <to usec="0" sec="1201929010"/>
    </anomaly>
    <anomaly type="suspicious" value="0.893702,1.117450,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="134.214.125.50" dst_ip="141.54.59.136" src_port="80"/>
        </slice>
        <from usec="0" sec="1201928515"/>
        <to usec="0" sec="1201928535"/>
    </anomaly>
    <anomaly type="suspicious" value="0.893702,1.117450,503,1 1 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="141.54.113.174" dst_ip="18.166.18.86" dst_port="80"/>
            <filter src_ip="141.54.113.174" dst_ip="16.220.33.161" dst_port="80"/>
        </slice>
        <from usec="0" sec="1201928792"/>
        <to usec="0" sec="1201928935"/>
    </anomaly>
    <anomaly type="suspicious" value="0.838935,1.063620,503,1 1 0 1 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="141.54.59.136" dst_port="80"/>
        </slice>
        <from usec="0" sec="1201928401"/>
        <to usec="0" sec="1201929150"/>
    </anomaly>
    <anomaly type="suspicious" value="0.838935,1.063620,503,1 1 0 1 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="141.54.139.147" dst_port="53"/>
            <filter src_ip="141.54.139.147" dst_ip="101.246.95.55" dst_port="80"/>
        </slice>
        <from usec="0" sec="1201928401"/>
        <to usec="0" sec="1201929000"/>
    </anomaly>
    <anomaly type="suspicious" value="0.893702,1.117450,503,1 1 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="44.78.172.156" dst_ip="138.49.143.67" src_port="22919" dst_port="80"/>
            <filter src_ip="44.78.172.156" dst_ip="138.49.143.67" src_port="22918" dst_port="80"/>
            <filter src_ip="44.78.172.156" dst_ip="138.49.137.124" src_port="22924" dst_port="80"/>
        </slice>
        <from usec="0" sec="1201928653"/>
        <to usec="0" sec="1201928660"/>
    </anomaly>
    <anomaly type="suspicious" value="0.893702,1.117450,503,1 1 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="141.54.245.182" dst_ip="216.236.218.3" dst_port="80"/>
            <filter src_ip="141.54.245.182" dst_ip="211.219.64.20" dst_port="80"/>
        </slice>
        <from usec="0" sec="1201928996"/>
        <to usec="0" sec="1201929001"/>
    </anomaly>
    <anomaly type="suspicious" value="0.839475,1.142770,901,0 1 0 0 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="202.144.5.55" dst_port="53" proto="tcp"/>
        </slice>
        <from usec="0" sec="1201928830"/>
        <to usec="0" sec="1201929012"/>
    </anomaly>
    <anomaly type="suspicious" value="0.839475,1.142770,901,0 1 0 0 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="194.245.40.63" dst_ip="194.245.40.63" proto="icmp"/>
        </slice>
        <from usec="0" sec="1201928428"/>
        <to usec="0" sec="1201928469"/>
    </anomaly>
    <anomaly type="suspicious" value="0.893702,1.117450,503,1 1 0 0 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="138.43.161.106" dst_port="80"/>
        </slice>
        <from usec="0" sec="1201929126"/>
        <to usec="0" sec="1201929131"/>
    </anomaly>
    <anomaly type="suspicious" value="0.838935,1.063620,012,1 1 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="195.178.76.161" dst_ip="208.181.133.23" dst_port="80"/>
        </slice>
        <from usec="0" sec="1201928401"/>
        <to usec="0" sec="1201928899"/>
    </anomaly>
    <anomaly type="suspicious" value="0.893702,1.117450,503,1 1 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="138.43.70.198" dst_ip="220.119.245.60" src_port="62155" dst_port="80"/>
            <filter src_ip="138.43.70.198" dst_ip="220.119.245.60" src_port="1118" dst_port="80"/>
            <filter src_ip="138.43.70.198" dst_ip="220.119.245.60" src_port="1113" dst_port="80"/>
            <filter src_ip="138.43.70.198" dst_ip="151.252.136.137" src_port="1110" dst_port="80"/>
        </slice>
        <from usec="0" sec="1201928636"/>
        <to usec="0" sec="1201929010"/>
    </anomaly>
    <anomaly type="suspicious" value="0.893702,1.117450,503,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="195.236.136.146" dst_ip="194.245.40.50" src_port="49179" dst_port="80"/>
            <filter src_ip="195.236.136.146" dst_ip="194.245.40.50" src_port="49171" dst_port="80"/>
        </slice>
        <from usec="0" sec="1201928893"/>
        <to usec="0" sec="1201928957"/>
    </anomaly>
    <anomaly type="suspicious" value="0.893702,1.117450,002,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="93.138.184.11" src_port="62708" dst_port="137"/>
        </slice>
        <from usec="0" sec="1201929026"/>
        <to usec="0" sec="1201929040"/>
    </anomaly>
    <anomaly type="suspicious" value="0.893702,1.117450,002,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="3.206.34.163" src_port="1100" dst_port="137"/>
        </slice>
        <from usec="0" sec="1201928755"/>
        <to usec="0" sec="1201928768"/>
    </anomaly>
    <anomaly type="suspicious" value="0.893702,1.117450,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="42.132.98.96" dst_port="445"/>
        </slice>
        <from usec="0" sec="1201928447"/>
        <to usec="0" sec="1201928472"/>
    </anomaly>
    <anomaly type="suspicious" value="1.274810,1.344730,901,0 0 1 0 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="194.245.40.63" dst_ip="194.245.40.63" proto="icmp"/>
        </slice>
        <from usec="0" sec="1201928428"/>
        <to usec="0" sec="1201928469"/>
    </anomaly>
    <anomaly type="suspicious" value="0.876871,1.112210,999,0 0 0 1 1 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="169.16.18.68" src_port="7134"/>
            <filter src_ip="169.16.18.68" src_port="7100"/>
        </slice>
        <from usec="0" sec="1201928401"/>
        <to usec="0" sec="1201929139"/>
    </anomaly>
    <anomaly type="suspicious" value="0.928917,1.086180,503,1 0 0 1 1 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="202.230.71.243" dst_ip="141.54.59.136" src_port="80"/>
        </slice>
        <from usec="0" sec="1201928401"/>
        <to usec="0" sec="1201928596"/>
    </anomaly>
    <anomaly type="suspicious" value="0.928917,1.086180,503,1 0 0 1 1 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter dst_ip="141.54.126.40" src_port="80"/>
            <filter src_ip="45.188.63.163" dst_ip="141.54.174.163" src_port="80"/>
        </slice>
        <from usec="0" sec="1201928406"/>
        <to usec="0" sec="1201929048"/>
    </anomaly>
    <anomaly type="suspicious" value="0.928917,1.086180,501,1 0 0 1 1 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="194.245.35.29" dst_port="21"/>
        </slice>
        <from usec="0" sec="1201928401"/>
        <to usec="0" sec="1201929012"/>
    </anomaly>
    <anomaly type="suspicious" value="0.876871,1.112210,999,0 0 0 1 1 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="194.245.36.5" src_port="53"/>
        </slice>
        <from usec="0" sec="1201928401"/>
        <to usec="0" sec="1201929138"/>
    </anomaly>
    <anomaly type="suspicious" value="0.876871,1.112210,503,0 0 0 1 1 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="19.39.38.82" dst_ip="138.43.160.186" src_port="80"/>
            <filter src_ip="202.163.147.187" dst_ip="138.43.160.186" src_port="80"/>
        </slice>
        <from usec="0" sec="1201928401"/>
        <to usec="0" sec="1201928508"/>
    </anomaly>
    <anomaly type="suspicious" value="0.876871,1.112210,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="22.3.4.65" dst_ip="195.187.236.19" src_port="80" dst_port="4859"/>
            <filter src_ip="22.3.4.65" dst_ip="195.187.236.19" src_port="80" dst_port="4614"/>
        </slice>
        <from usec="0" sec="1201928401"/>
        <to usec="0" sec="1201928477"/>
    </anomaly>
    <anomaly type="suspicious" value="0.876871,1.112210,503,0 0 0 1 1 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="194.35.237.134" dst_port="80"/>
        </slice>
        <from usec="0" sec="1201928402"/>
        <to usec="0" sec="1201928666"/>
    </anomaly>
    <anomaly type="suspicious" value="0.928917,1.086180,020,1 0 0 1 1 0 0 0 0 0 0 0,ntscTCPTCPICrp">
        <slice>
            <filter dst_ip="19.39.198.56" dst_port="80"/>
            <filter dst_ip="19.39.198.56"/>
        </slice>
        <from usec="0" sec="1201928401"/>
        <to usec="0" sec="1201928875"/>
    </anomaly>
    <anomaly type="suspicious" value="0.876871,1.112210,999,0 0 0 1 1 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="145.195.233.35" src_port="5152"/>
            <filter src_ip="145.195.233.35" dst_ip="213.56.20.1" dst_port="4160"/>
        </slice>
        <from usec="0" sec="1201928401"/>
        <to usec="0" sec="1201928689"/>
    </anomaly>
    <anomaly type="suspicious" value="0.876871,1.112210,503,0 0 0 1 1 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="213.33.31.185" dst_ip="138.49.11.158" src_port="80"/>
        </slice>
        <from usec="0" sec="1201928638"/>
        <to usec="0" sec="1201928678"/>
    </anomaly>
    <anomaly type="suspicious" value="0.876871,1.112210,010,0 0 0 1 1 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="32.73.69.56" dst_ip="138.43.161.181" dst_port="25"/>
            <filter src_ip="32.73.69.56" dst_ip="138.43.161.12" dst_port="25"/>
        </slice>
        <from usec="0" sec="1201928643"/>
        <to usec="0" sec="1201928689"/>
    </anomaly>
    <anomaly type="suspicious" value="0.928917,1.086180,503,1 0 0 1 1 0 0 0 0 0 0 0,ntscACKt">
        <slice>
            <filter src_ip="18.133.40.155" src_port="80"/>
        </slice>
        <from usec="0" sec="1201928401"/>
        <to usec="0" sec="1201929008"/>
    </anomaly>
    <anomaly type="suspicious" value="0.876871,1.112210,503,0 0 0 1 1 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="169.16.18.43" dst_ip="197.145.196.173" dst_port="80"/>
            <filter src_ip="169.16.18.43" dst_ip="70.39.165.161" dst_port="80"/>
            <filter src_ip="169.16.18.43" dst_ip="197.145.197.60" dst_port="80"/>
        </slice>
        <from usec="0" sec="1201928418"/>
        <to usec="0" sec="1201928753"/>
    </anomaly>
    <anomaly type="suspicious" value="0.876871,1.112210,999,0 0 0 1 1 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="93.34.173.206" dst_port="53"/>
            <filter src_ip="93.34.173.206" dst_ip="141.54.61.72" dst_port="25"/>
        </slice>
        <from usec="0" sec="1201928449"/>
        <to usec="0" sec="1201928830"/>
    </anomaly>
    <anomaly type="suspicious" value="0.876871,1.112210,999,0 0 0 1 1 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="1.1.107.72" dst_port="3127"/>
            <filter dst_ip="169.16.175.11" dst_port="3127"/>
            <filter src_ip="1.1.107.72" dst_ip="169.16.175.11" dst_port="3128"/>
        </slice>
        <from usec="0" sec="1201928449"/>
        <to usec="0" sec="1201929049"/>
    </anomaly>
    <anomaly type="suspicious" value="0.876871,1.112210,999,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="141.54.61.71" dst_ip="88.27.164.54" src_port="25"/>
        </slice>
        <from usec="0" sec="1201928927"/>
        <to usec="0" sec="1201929139"/>
    </anomaly>
    <anomaly type="suspicious" value="0.932302,1.174480,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="138.43.146.217"/>
        </slice>
        <from usec="0" sec="1201928401"/>
        <to usec="0" sec="1201928447"/>
    </anomaly>
    <anomaly type="suspicious" value="0.932302,1.174480,999,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="194.245.40.50"/>
        </slice>
        <from usec="0" sec="1201928401"/>
        <to usec="0" sec="1201928447"/>
    </anomaly>
    <anomaly type="suspicious" value="0.932302,1.174480,010,0 0 0 0 0 0 1 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="90.131.69.137"/>
        </slice>
        <from usec="0" sec="1201928851"/>
        <to usec="0" sec="1201928897"/>
    </anomaly>
    <anomaly type="suspicious" value="0.932302,1.174480,002,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="93.35.41.12" dst_port="137"/>
        </slice>
        <from usec="0" sec="1201928851"/>
        <to usec="0" sec="1201928897"/>
    </anomaly>
    <anomaly type="suspicious" value="0.931816,1.097630,901,1 0 0 1 0 0 1 0 0 0 0 0,empty">
        <slice/>
        <from usec="0" sec="1201928401"/>
        <to usec="0" sec="1201929200"/>
    </anomaly>
    <anomaly type="suspicious" value="0.932302,1.174480,010,0 0 0 0 0 0 1 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="213.12.119.243" src_port="80"/>
        </slice>
        <from usec="0" sec="1201928941"/>
        <to usec="0" sec="1201928987"/>
    </anomaly>
    <anomaly type="suspicious" value="0.981413,1.149860,504,1 0 0 0 0 0 1 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="44.79.148.38" dst_ip="138.49.189.247" dst_port="443"/>
        </slice>
        <from usec="0" sec="1201928863"/>
        <to usec="0" sec="1201928987"/>
    </anomaly>
    <anomaly type="suspicious" value="0.932302,1.174480,503,0 0 0 0 0 0 1 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="214.196.79.164" src_port="80"/>
        </slice>
        <from usec="0" sec="1201928941"/>
        <to usec="0" sec="1201928987"/>
    </anomaly>
    <anomaly type="suspicious" value="0.879942,1.123400,010,0 0 0 1 0 0 1 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="19.39.198.56" src_port="80"/>
        </slice>
        <from usec="0" sec="1201928407"/>
        <to usec="0" sec="1201929049"/>
    </anomaly>
    <anomaly type="suspicious" value="0.932302,1.174480,999,0 0 0 0 0 0 1 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="211.80.2.91" dst_ip="169.16.175.11" dst_port="3128"/>
            <filter src_ip="211.80.2.91" dst_ip="169.16.175.10" dst_port="3128"/>
            <filter src_ip="211.80.2.91" dst_ip="169.16.175.2" dst_port="3128"/>
        </slice>
        <from usec="0" sec="1201928941"/>
        <to usec="0" sec="1201928987"/>
    </anomaly>
    <anomaly type="suspicious" value="0.932302,1.174480,999,0 0 0 0 0 0 1 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="138.43.28.134" dst_ip="90.139.30.127" dst_port="53"/>
            <filter src_ip="138.43.28.161" dst_ip="90.139.30.127" dst_port="53"/>
        </slice>
        <from usec="0" sec="1201928626"/>
        <to usec="0" sec="1201928987"/>
    </anomaly>
    <anomaly type="suspicious" value="0.932302,1.174480,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="169.16.175.2" src_port="27531"/>
        </slice>
        <from usec="0" sec="1201928986"/>
        <to usec="0" sec="1201929032"/>
    </anomaly>
</admd:annotation>
