<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="anomalous" value="1.873550,1.740200,503,1 0 0 1 1 1 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="85.225.136.186" src_port="80"/>
        </slice>
        <from usec="0" sec="1204520570"/>
        <to usec="0" sec="1204520841"/>
    </anomaly>
    <anomaly type="anomalous" value="1.441740,1.352180,020,1 1 1 1 0 0 0 0 0 0 0 0,ttl_error">
        <slice>
            <filter src_ip="156.131.208.36"/>
        </slice>
        <from usec="0" sec="1204520400"/>
        <to usec="0" sec="1204521267"/>
    </anomaly>
    <anomaly type="anomalous" value="1.449760,1.378570,503,1 1 1 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="153.253.86.81" dst_ip="197.144.32.148" src_port="1184" dst_port="80"/>
            <filter src_ip="153.253.86.81" dst_ip="197.144.32.148" src_port="1181" dst_port="80"/>
            <filter src_ip="153.253.86.81" dst_ip="197.144.32.149" src_port="1186" dst_port="80"/>
            <filter src_ip="153.253.86.81" dst_ip="192.19.180.57" src_port="4040" dst_port="80"/>
        </slice>
        <from usec="0" sec="1204520674"/>
        <to usec="0" sec="1204520679"/>
    </anomaly>
    <anomaly type="anomalous" value="2.165770,1.732180,010,1 1 1 0 0 0 1 1 1 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="223.38.40.87" dst_port="25"/>
        </slice>
        <from usec="0" sec="1204520400"/>
        <to usec="0" sec="1204521301"/>
    </anomaly>
    <anomaly type="anomalous" value="1.449760,1.378570,503,1 1 1 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="213.157.17.78" dst_ip="153.253.158.141" src_port="80" dst_port="1271"/>
        </slice>
        <from usec="0" sec="1204521214"/>
        <to usec="0" sec="1204521218"/>
    </anomaly>
    <anomaly type="anomalous" value="1.002280,0.992392,503,1 1 0 1 1 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="71.48.136.66" dst_ip="153.253.178.67" src_port="80"/>
        </slice>
        <from usec="0" sec="1204520400"/>
        <to usec="0" sec="1204521273"/>
    </anomaly>
    <anomaly type="anomalous" value="1.002280,0.992392,503,1 1 0 1 1 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="153.253.116.206" dst_ip="38.214.94.197" dst_port="80"/>
        </slice>
        <from usec="0" sec="1204520400"/>
        <to usec="0" sec="1204521124"/>
    </anomaly>
    <anomaly type="anomalous" value="1.449760,1.378570,999,1 1 1 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="164.232.11.246" dst_ip="45.202.205.89" dst_port="25"/>
        </slice>
        <from usec="0" sec="1204520511"/>
        <to usec="0" sec="1204521102"/>
    </anomaly>
    <anomaly type="anomalous" value="2.320760,2.038360,503,1 1 1 1 1 1 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter src_ip="71.57.228.91" dst_ip="197.33.219.88"/>
            <filter dst_ip="197.33.219.88" dst_port="80"/>
        </slice>
        <from usec="0" sec="1204520400"/>
        <to usec="0" sec="1204521299"/>
    </anomaly>
    <anomaly type="anomalous" value="1.441740,1.352180,503,1 1 1 1 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="153.253.99.197" dst_ip="197.144.32.8" src_port="1203" dst_port="80"/>
            <filter src_ip="153.253.99.197" dst_ip="197.144.32.8" src_port="1198" dst_port="80"/>
            <filter src_ip="153.253.99.197" dst_ip="197.144.32.210" src_port="1217" dst_port="80"/>
            <filter src_ip="153.253.99.197" dst_ip="197.144.32.10" src_port="1172" dst_port="80"/>
        </slice>
        <from usec="0" sec="1204520900"/>
        <to usec="0" sec="1204521134"/>
    </anomaly>
    <anomaly type="anomalous" value="1.002280,0.992392,999,1 1 0 1 1 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="197.33.212.100" dst_port="6970"/>
            <filter src_ip="35.40.107.97" dst_ip="197.33.212.100" src_port="8080"/>
        </slice>
        <from usec="0" sec="1204520400"/>
        <to usec="0" sec="1204521299"/>
    </anomaly>
    <anomaly type="anomalous" value="1.002280,0.992392,503,1 1 0 1 1 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="156.161.181.58" dst_ip="138.49.157.121" dst_port="80"/>
        </slice>
        <from usec="0" sec="1204520400"/>
        <to usec="0" sec="1204520624"/>
    </anomaly>
    <anomaly type="anomalous" value="1.449760,1.378570,503,1 1 1 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="196.25.148.26" dst_ip="197.144.32.243" src_port="49207" dst_port="80"/>
            <filter src_ip="196.25.148.26" dst_ip="215.16.155.50" src_port="49211" dst_port="80"/>
        </slice>
        <from usec="0" sec="1204521113"/>
        <to usec="0" sec="1204521124"/>
    </anomaly>
    <anomaly type="anomalous" value="1.441740,1.352180,999,1 1 1 1 0 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="197.33.208.41" src_port="25"/>
            <filter src_ip="156.103.128.6" dst_ip="214.29.71.121"/>
            <filter src_ip="156.103.128.6" dst_port="25"/>
            <filter dst_ip="214.29.71.121" dst_port="25"/>
        </slice>
        <from usec="0" sec="1204520400"/>
        <to usec="0" sec="1204521183"/>
    </anomaly>
    <anomaly type="anomalous" value="1.449760,1.378570,011,1 1 1 0 0 0 0 0 0 0 0 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="196.252.58.42" src_port="8080"/>
            <filter dst_ip="196.252.58.42" src_port="6588"/>
            <filter dst_ip="196.252.58.42" src_port="3128"/>
        </slice>
        <from usec="0" sec="1204520657"/>
        <to usec="0" sec="1204520719"/>
    </anomaly>
    <anomaly type="anomalous" value="1.449760,1.378570,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="12.48.64.67"/>
        </slice>
        <from usec="0" sec="1204520716"/>
        <to usec="0" sec="1204520720"/>
    </anomaly>
    <anomaly type="anomalous" value="1.078730,1.046360,999,1 1 0 0 0 0 1 0 0 0 0 0,heavy_hitter">
        <slice>
            <filter src_ip="46.104.165.123" dst_ip="197.33.211.35" dst_port="3127"/>
        </slice>
        <from usec="0" sec="1204521255"/>
        <to usec="0" sec="1204521301"/>
    </anomaly>
    <anomaly type="anomalous" value="1.002280,0.992392,503,1 1 0 1 1 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="223.187.211.10" dst_port="80"/>
        </slice>
        <from usec="0" sec="1204520400"/>
        <to usec="0" sec="1204521290"/>
    </anomaly>
    <anomaly type="anomalous" value="1.449760,1.378570,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="223.87.103.82" src_port="6000" dst_port="135"/>
        </slice>
        <from usec="0" sec="1204520460"/>
        <to usec="0" sec="1204520461"/>
    </anomaly>
    <anomaly type="anomalous" value="2.823950,2.292350,010,1 1 1 1 1 1 1 1 1 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="222.70.54.161" src_port="6000" dst_port="2967"/>
        </slice>
        <from usec="0" sec="1204520400"/>
        <to usec="0" sec="1204521217"/>
    </anomaly>
    <anomaly type="anomalous" value="1.449760,1.378570,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="196.168.136.5" dst_port="135"/>
        </slice>
        <from usec="0" sec="1204520983"/>
        <to usec="0" sec="1204521060"/>
    </anomaly>
    <anomaly type="anomalous" value="1.449760,1.378570,001,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNtSAbado">
        <slice>
            <filter src_ip="12.48.64.67" dst_port="5554"/>
            <filter src_ip="12.48.64.67" dst_port="1023"/>
            <filter src_ip="12.48.64.67" dst_port="9898"/>
        </slice>
        <from usec="0" sec="1204520715"/>
        <to usec="0" sec="1204520720"/>
    </anomaly>
    <anomaly type="anomalous" value="1.078730,1.046360,999,1 1 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="213.144.28.74"/>
        </slice>
        <from usec="0" sec="1204520580"/>
        <to usec="0" sec="1204521265"/>
    </anomaly>
    <anomaly type="anomalous" value="1.611440,1.420610,503,1 1 1 1 1 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="197.33.208.206" dst_port="80"/>
        </slice>
        <from usec="0" sec="1204520400"/>
        <to usec="0" sec="1204521290"/>
    </anomaly>
    <anomaly type="anomalous" value="1.873690,1.754080,503,0 0 0 1 1 1 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="5.202.81.132" dst_ip="153.253.116.229" src_port="80" dst_port="3200"/>
            <filter src_ip="84.148.172.72" dst_ip="153.253.116.229" src_port="2885" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1204520549"/>
        <to usec="0" sec="1204520611"/>
    </anomaly>
    <anomaly type="anomalous" value="1.947760,1.766810,501,1 1 0 1 1 1 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="197.33.220.72" src_port="21"/>
        </slice>
        <from usec="0" sec="1204520400"/>
        <to usec="0" sec="1204521286"/>
    </anomaly>
    <anomaly type="anomalous" value="1.002280,0.992392,503,1 1 0 1 1 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="197.33.219.88" dst_ip="71.57.228.91"/>
            <filter src_ip="197.33.219.88" src_port="80"/>
        </slice>
        <from usec="0" sec="1204520400"/>
        <to usec="0" sec="1204521293"/>
    </anomaly>
    <anomaly type="anomalous" value="1.002280,0.992392,503,1 1 0 1 1 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="197.33.208.206" src_port="80"/>
        </slice>
        <from usec="0" sec="1204520400"/>
        <to usec="0" sec="1204521293"/>
    </anomaly>
    <anomaly type="anomalous" value="1.753620,1.376620,503,1 1 0 1 0 0 1 1 1 0 0 0,heavy_hitter">
        <slice>
            <filter src_ip="166.218.214.162" dst_ip="46.106.12.197" dst_port="80"/>
        </slice>
        <from usec="0" sec="1204520400"/>
        <to usec="0" sec="1204521299"/>
    </anomaly>
    <anomaly type="anomalous" value="2.277170,1.765820,999,1 1 1 1 1 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_ip="156.103.129.30" src_port="25"/>
            <filter src_ip="156.103.129.30" dst_port="25"/>
            <filter src_ip="196.16.238.94" dst_port="25"/>
        </slice>
        <from usec="0" sec="1204520400"/>
        <to usec="0" sec="1204521296"/>
    </anomaly>
    <anomaly type="anomalous" value="1.873690,1.754080,503,0 0 0 1 1 1 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="214.29.32.50" dst_ip="164.232.102.169" src_port="995" dst_port="3099"/>
            <filter src_ip="214.29.51.96" dst_ip="164.232.102.169" src_port="80" dst_port="3100"/>
            <filter src_ip="5.202.81.145" dst_ip="164.232.102.169" src_port="80" dst_port="3092"/>
            <filter src_ip="82.150.49.127" dst_ip="164.232.102.169" src_port="25211" dst_port="43091"/>
        </slice>
        <from usec="0" sec="1204520400"/>
        <to usec="0" sec="1204520740"/>
    </anomaly>
    <anomaly type="anomalous" value="1.611440,1.420610,999,1 1 1 1 1 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="153.253.86.14" dst_port="1031"/>
            <filter src_ip="71.48.131.128" dst_ip="153.253.86.14" src_port="80"/>
        </slice>
        <from usec="0" sec="1204520464"/>
        <to usec="0" sec="1204521273"/>
    </anomaly>
    <anomaly type="anomalous" value="1.441740,1.352180,503,1 1 1 1 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="153.253.66.51" dst_port="80"/>
            <filter src_ip="153.253.66.51" dst_port="8612"/>
            <filter src_ip="153.253.95.243" dst_ip="214.29.10.188" dst_port="80"/>
        </slice>
        <from usec="0" sec="1204520400"/>
        <to usec="0" sec="1204521281"/>
    </anomaly>
    <anomaly type="anomalous" value="1.873550,1.740200,999,1 0 0 1 1 1 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="131.66.146.154" dst_ip="36.56.2.204"/>
            <filter src_ip="131.66.203.225" dst_ip="36.56.2.204" src_port="80"/>
            <filter src_ip="156.120.33.47" dst_ip="36.56.2.204" src_port="80"/>
        </slice>
        <from usec="0" sec="1204520400"/>
        <to usec="0" sec="1204521292"/>
    </anomaly>
    <anomaly type="anomalous" value="1.287870,1.101160,999,1 1 0 1 1 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="156.103.178.254" dst_port="65013"/>
        </slice>
        <from usec="0" sec="1204520400"/>
        <to usec="0" sec="1204521270"/>
    </anomaly>
    <anomaly type="anomalous" value="1.002280,0.992392,503,1 1 0 1 1 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="153.253.115.230" dst_port="80"/>
            <filter src_ip="153.253.116.177" dst_ip="212.116.179.88" dst_port="80"/>
        </slice>
        <from usec="0" sec="1204520422"/>
        <to usec="0" sec="1204521236"/>
    </anomaly>
    <anomaly type="anomalous" value="1.441740,1.352180,999,1 1 1 1 0 0 0 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="156.103.3.152" src_port="53"/>
        </slice>
        <from usec="0" sec="1204520400"/>
        <to usec="0" sec="1204521270"/>
    </anomaly>
    <anomaly type="anomalous" value="2.277170,1.765820,503,1 1 1 1 1 0 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="196.16.199.248" dst_port="80"/>
        </slice>
        <from usec="0" sec="1204520400"/>
        <to usec="0" sec="1204521299"/>
    </anomaly>
    <anomaly type="anomalous" value="2.277170,1.765820,020,1 1 1 1 1 0 1 1 1 0 0 0,ntscICec">
        <slice>
            <filter src_ip="197.33.208.145"/>
        </slice>
        <from usec="0" sec="1204520401"/>
        <to usec="0" sec="1204521228"/>
    </anomaly>
    <anomaly type="anomalous" value="1.873690,1.754080,503,0 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="5.202.81.161" dst_ip="164.232.169.186" src_port="80" dst_port="32846"/>
        </slice>
        <from usec="0" sec="1204521071"/>
        <to usec="0" sec="1204521210"/>
    </anomaly>
    <anomaly type="anomalous" value="1.002280,0.992392,503,1 1 0 1 1 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="153.253.178.67" dst_port="80"/>
            <filter src_ip="153.253.86.14" dst_port="80"/>
        </slice>
        <from usec="0" sec="1204520400"/>
        <to usec="0" sec="1204521299"/>
    </anomaly>
    <anomaly type="anomalous" value="1.002280,0.992392,501,1 1 0 1 1 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="197.33.220.72" dst_port="21"/>
        </slice>
        <from usec="0" sec="1204520400"/>
        <to usec="0" sec="1204521301"/>
    </anomaly>
    <anomaly type="anomalous" value="1.819410,1.428290,999,0 0 0 1 1 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="156.131.209.23" src_port="63789"/>
        </slice>
        <from usec="0" sec="1204520400"/>
        <to usec="0" sec="1204521228"/>
    </anomaly>
    <anomaly type="anomalous" value="1.873550,1.740200,503,1 0 0 1 1 1 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="153.253.86.81" src_port="80"/>
            <filter dst_ip="153.253.86.81" dst_port="37217"/>
        </slice>
        <from usec="0" sec="1204520400"/>
        <to usec="0" sec="1204520696"/>
    </anomaly>
    <anomaly type="anomalous" value="1.873690,1.754080,503,0 0 0 1 1 1 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="197.144.32.10" dst_ip="153.253.237.240" src_port="80" dst_port="1067"/>
            <filter src_ip="197.144.32.10" dst_ip="153.253.237.240" src_port="80" dst_port="1065"/>
            <filter src_ip="197.144.32.10" dst_ip="153.253.99.197" src_port="80" dst_port="1172"/>
            <filter src_ip="197.144.32.10" dst_ip="153.253.106.82" src_port="80" dst_port="1033"/>
            <filter src_ip="197.144.32.10" dst_ip="156.103.128.57" src_port="80" dst_port="40425"/>
        </slice>
        <from usec="0" sec="1204520810"/>
        <to usec="0" sec="1204520910"/>
    </anomaly>
    <anomaly type="anomalous" value="1.873550,1.740200,503,1 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="5.202.68.96" dst_ip="156.124.212.113" src_port="80"/>
        </slice>
        <from usec="0" sec="1204520400"/>
        <to usec="0" sec="1204521228"/>
    </anomaly>
    <anomaly type="anomalous" value="1.873690,1.754080,999,0 0 0 1 1 1 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="153.253.133.53" src_port="25"/>
            <filter src_ip="153.253.133.53" src_port="53"/>
        </slice>
        <from usec="0" sec="1204520408"/>
        <to usec="0" sec="1204521048"/>
    </anomaly>
    <anomaly type="anomalous" value="1.873690,1.754080,503,0 0 0 1 1 1 0 0 0 0 0 0,point_to_point">
        <slice>
            <filter src_ip="197.132.208.51" dst_ip="153.253.88.216" src_port="80"/>
        </slice>
        <from usec="0" sec="1204520400"/>
        <to usec="0" sec="1204521040"/>
    </anomaly>
    <anomaly type="anomalous" value="1.873550,1.740200,503,1 0 0 1 1 1 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="196.16.238.34" src_port="80"/>
            <filter dst_ip="196.16.238.34" src_port="53"/>
        </slice>
        <from usec="0" sec="1204520400"/>
        <to usec="0" sec="1204521286"/>
    </anomaly>
    <anomaly type="anomalous" value="1.611440,1.420610,503,1 1 1 1 1 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="164.232.94.2" dst_port="80"/>
        </slice>
        <from usec="0" sec="1204520400"/>
        <to usec="0" sec="1204521283"/>
    </anomaly>
    <anomaly type="anomalous" value="1.895600,1.443890,999,1 1 0 1 1 0 1 1 1 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="196.172.133.186" dst_ip="50.176.254.249" src_port="53"/>
        </slice>
        <from usec="0" sec="1204520400"/>
        <to usec="0" sec="1204521301"/>
    </anomaly>
    <anomaly type="anomalous" value="1.873690,1.754080,503,0 0 0 1 1 1 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="197.144.32.210" dst_ip="153.253.99.197"/>
            <filter src_ip="197.144.32.210" dst_ip="153.253.229.252" src_port="80"/>
            <filter src_ip="197.144.32.210" dst_ip="153.253.66.51" src_port="80"/>
            <filter src_ip="197.144.32.8" dst_ip="153.253.99.197" src_port="80"/>
        </slice>
        <from usec="0" sec="1204520933"/>
        <to usec="0" sec="1204521134"/>
    </anomaly>
    <anomaly type="anomalous" value="1.002280,0.992392,503,1 1 0 1 1 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="209.78.148.252" dst_ip="153.253.70.228" src_port="80"/>
        </slice>
        <from usec="0" sec="1204520400"/>
        <to usec="0" sec="1204521297"/>
    </anomaly>
    <anomaly type="anomalous" value="1.584230,1.247990,503,1 1 0 1 1 0 1 1 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="153.253.70.228" dst_port="80"/>
            <filter src_ip="153.253.107.145" dst_port="80"/>
        </slice>
        <from usec="0" sec="1204520400"/>
        <to usec="0" sec="1204521293"/>
    </anomaly>
    <anomaly type="anomalous" value="2.025330,1.609590,503,1 1 1 1 1 0 1 1 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="164.232.94.2" src_port="80"/>
        </slice>
        <from usec="0" sec="1204520400"/>
        <to usec="0" sec="1204521156"/>
    </anomaly>
    <anomaly type="anomalous" value="1.670960,1.360250,999,0 0 0 1 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_ip="82.150.217.152" dst_port="3124"/>
            <filter src_ip="82.150.217.152" dst_port="3128"/>
            <filter src_ip="82.150.217.152" dst_port="3127"/>
            <filter dst_ip="197.33.211.35" dst_port="3128"/>
        </slice>
        <from usec="0" sec="1204520400"/>
        <to usec="0" sec="1204521228"/>
    </anomaly>
    <anomaly type="anomalous" value="1.670960,1.360250,999,0 0 0 1 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="153.253.9.220" src_port="62385"/>
        </slice>
        <from usec="0" sec="1204520402"/>
        <to usec="0" sec="1204520671"/>
    </anomaly>
    <anomaly type="anomalous" value="2.526360,2.054650,503,1 1 0 1 1 1 1 1 1 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="197.69.118.166" dst_ip="196.16.199.248" src_port="80"/>
        </slice>
        <from usec="0" sec="1204520400"/>
        <to usec="0" sec="1204521257"/>
    </anomaly>
    <anomaly type="anomalous" value="1.307130,1.150190,010,0 0 0 1 0 0 1 1 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="46.104.137.92" src_port="80"/>
        </slice>
        <from usec="0" sec="1204520400"/>
        <to usec="0" sec="1204520868"/>
    </anomaly>
    <anomaly type="anomalous" value="2.277170,1.765820,999,1 1 1 1 1 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="200.153.147.100" src_port="53"/>
        </slice>
        <from usec="0" sec="1204520400"/>
        <to usec="0" sec="1204521286"/>
    </anomaly>
    <anomaly type="anomalous" value="1.670960,1.360250,999,0 0 0 1 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="83.134.247.141" src_port="3077" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1204520400"/>
        <to usec="0" sec="1204521138"/>
    </anomaly>
    <anomaly type="anomalous" value="1.670960,1.360250,999,0 0 0 1 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="197.139.190.231" src_port="2305" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1204520400"/>
        <to usec="0" sec="1204521138"/>
    </anomaly>
    <anomaly type="anomalous" value="2.277170,1.765820,999,1 1 1 1 1 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="156.103.3.152" dst_port="53"/>
        </slice>
        <from usec="0" sec="1204520400"/>
        <to usec="0" sec="1204521301"/>
    </anomaly>
    <anomaly type="anomalous" value="1.803000,1.498610,999,1 1 1 1 1 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="200.153.147.100" dst_port="53"/>
        </slice>
        <from usec="0" sec="1204520400"/>
        <to usec="0" sec="1204521299"/>
    </anomaly>
    <anomaly type="anomalous" value="1.677890,1.386490,010,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="46.104.60.99"/>
        </slice>
        <from usec="0" sec="1204520400"/>
        <to usec="0" sec="1204520446"/>
    </anomaly>
    <anomaly type="anomalous" value="1.677890,1.386490,010,0 0 0 0 0 0 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="5.36.9.208" src_port="80" dst_port="61234"/>
        </slice>
        <from usec="0" sec="1204520400"/>
        <to usec="0" sec="1204520446"/>
    </anomaly>
    <anomaly type="anomalous" value="1.315980,1.181110,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="156.103.161.117" src_port="20641"/>
        </slice>
        <from usec="0" sec="1204520625"/>
        <to usec="0" sec="1204520671"/>
    </anomaly>
    <anomaly type="anomalous" value="1.670960,1.360250,999,0 0 0 1 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="153.253.210.42" src_port="64361"/>
        </slice>
        <from usec="0" sec="1204520400"/>
        <to usec="0" sec="1204521214"/>
    </anomaly>
    <anomaly type="anomalous" value="1.670960,1.360250,999,0 0 0 1 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="156.103.178.254" src_port="65013"/>
        </slice>
        <from usec="0" sec="1204520400"/>
        <to usec="0" sec="1204521134"/>
    </anomaly>
    <anomaly type="anomalous" value="1.677890,1.386490,020,0 0 0 0 0 0 1 1 1 0 0 0,ntscICec">
        <slice>
            <filter src_ip="50.85.67.121"/>
        </slice>
        <from usec="0" sec="1204520625"/>
        <to usec="0" sec="1204520671"/>
    </anomaly>
    <anomaly type="anomalous" value="1.677890,1.386490,010,0 0 0 0 0 0 1 1 1 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="209.59.144.100" dst_port="80"/>
        </slice>
        <from usec="0" sec="1204520625"/>
        <to usec="0" sec="1204520671"/>
    </anomaly>
    <anomaly type="anomalous" value="1.315980,1.181110,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="156.103.145.40" src_port="22801"/>
        </slice>
        <from usec="0" sec="1204520625"/>
        <to usec="0" sec="1204521301"/>
    </anomaly>
    <anomaly type="anomalous" value="1.307130,1.150190,010,0 0 0 1 0 0 1 1 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="218.171.173.141" src_port="80"/>
        </slice>
        <from usec="0" sec="1204520407"/>
        <to usec="0" sec="1204521224"/>
    </anomaly>
    <anomaly type="anomalous" value="1.677890,1.386490,999,0 0 0 0 0 0 1 1 1 0 0 0,heavy_hitter">
        <slice>
            <filter src_ip="215.42.195.49" dst_ip="197.33.211.35" dst_port="3127"/>
        </slice>
        <from usec="0" sec="1204520625"/>
        <to usec="0" sec="1204520671"/>
    </anomaly>
    <anomaly type="anomalous" value="1.315980,1.181110,010,0 0 0 0 0 0 1 1 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="83.179.142.28" src_port="80"/>
        </slice>
        <from usec="0" sec="1204520625"/>
        <to usec="0" sec="1204520671"/>
    </anomaly>
    <anomaly type="anomalous" value="1.677890,1.386490,010,0 0 0 0 0 0 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="5.36.9.208" src_port="80" dst_port="61234"/>
        </slice>
        <from usec="0" sec="1204520625"/>
        <to usec="0" sec="1204520671"/>
    </anomaly>
    <anomaly type="anomalous" value="1.677890,1.386490,503,0 0 0 0 0 0 1 1 1 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="164.232.199.13" dst_ip="39.98.16.39" dst_port="80"/>
            <filter src_ip="164.232.199.13" dst_ip="39.98.16.32" dst_port="80"/>
        </slice>
        <from usec="0" sec="1204520625"/>
        <to usec="0" sec="1204520671"/>
    </anomaly>
    <anomaly type="anomalous" value="1.677890,1.386490,999,0 0 0 0 0 0 1 1 1 0 0 0,heavy_hitter">
        <slice>
            <filter src_ip="193.182.84.231" dst_ip="197.33.211.35" dst_port="3127"/>
        </slice>
        <from usec="0" sec="1204520625"/>
        <to usec="0" sec="1204520671"/>
    </anomaly>
    <anomaly type="anomalous" value="1.315980,1.181110,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="216.88.19.79" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1204520625"/>
        <to usec="0" sec="1204520671"/>
    </anomaly>
    <anomaly type="anomalous" value="1.315980,1.181110,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="197.33.222.199" src_port="53"/>
        </slice>
        <from usec="0" sec="1204520625"/>
        <to usec="0" sec="1204520671"/>
    </anomaly>
    <anomaly type="anomalous" value="1.677740,1.368890,503,1 0 0 0 0 0 1 1 1 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="153.253.130.212" dst_ip="71.48.239.69" dst_port="80"/>
            <filter src_ip="153.253.130.212" dst_ip="71.48.239.96" dst_port="80"/>
        </slice>
        <from usec="0" sec="1204520625"/>
        <to usec="0" sec="1204521156"/>
    </anomaly>
    <anomaly type="anomalous" value="1.315780,1.160390,501,1 0 0 0 0 0 1 1 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="84.177.93.126" dst_ip="197.33.208.172" dst_port="21"/>
        </slice>
        <from usec="0" sec="1204520422"/>
        <to usec="0" sec="1204521121"/>
    </anomaly>
    <anomaly type="anomalous" value="1.760220,1.402550,010,1 1 0 0 0 0 1 1 1 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="84.215.64.15" dst_port="139"/>
            <filter src_ip="84.215.64.15" dst_port="445"/>
        </slice>
        <from usec="0" sec="1204520625"/>
        <to usec="0" sec="1204520694"/>
    </anomaly>
    <anomaly type="anomalous" value="1.677890,1.386490,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmpla">
        <slice>
            <filter src_ip="192.16.24.97" dst_port="3124"/>
        </slice>
        <from usec="0" sec="1204520625"/>
        <to usec="0" sec="1204520671"/>
    </anomaly>
    <anomaly type="anomalous" value="1.677890,1.386490,999,0 0 0 0 0 0 1 1 1 0 0 0,alphfl">
        <slice>
            <filter src_ip="192.16.24.97" dst_ip="197.33.211.35" dst_port="3127"/>
        </slice>
        <from usec="0" sec="1204520625"/>
        <to usec="0" sec="1204520671"/>
    </anomaly>
    <anomaly type="anomalous" value="1.819410,1.428290,999,0 0 0 1 1 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_ip="58.232.235.83" dst_ip="197.33.211.34"/>
            <filter src_ip="58.232.235.83" dst_port="3128"/>
            <filter src_ip="58.232.235.83" dst_port="3127"/>
            <filter dst_ip="197.33.211.34" dst_port="3128"/>
            <filter dst_ip="197.33.211.34" dst_port="3127"/>
            <filter dst_ip="197.33.211.45" dst_port="3128"/>
        </slice>
        <from usec="0" sec="1204520400"/>
        <to usec="0" sec="1204521228"/>
    </anomaly>
    <anomaly type="anomalous" value="2.277170,1.765820,999,1 1 1 1 1 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_port="3124"/>
            <filter src_ip="197.33.211.34" src_port="3128"/>
        </slice>
        <from usec="0" sec="1204520400"/>
        <to usec="0" sec="1204521293"/>
    </anomaly>
    <anomaly type="anomalous" value="1.677890,1.386490,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="84.148.172.72" src_port="2885" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1204520625"/>
        <to usec="0" sec="1204520671"/>
    </anomaly>
    <anomaly type="anomalous" value="1.677890,1.386490,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="196.213.32.31" src_port="1267" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1204520625"/>
        <to usec="0" sec="1204520671"/>
    </anomaly>
    <anomaly type="anomalous" value="1.677890,1.386490,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="144.96.16.238" src_port="1676" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1204520625"/>
        <to usec="0" sec="1204520671"/>
    </anomaly>
    <anomaly type="anomalous" value="1.677890,1.386490,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="196.214.224.227" src_port="1058" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1204520625"/>
        <to usec="0" sec="1204520671"/>
    </anomaly>
    <anomaly type="anomalous" value="1.677890,1.386490,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="196.213.143.104" src_port="1866" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1204520625"/>
        <to usec="0" sec="1204520671"/>
    </anomaly>
    <anomaly type="anomalous" value="1.677890,1.386490,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="216.69.10.13" src_port="1051" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1204520625"/>
        <to usec="0" sec="1204520671"/>
    </anomaly>
    <anomaly type="anomalous" value="1.677890,1.386490,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="222.12.86.183" src_port="1718" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1204520625"/>
        <to usec="0" sec="1204520671"/>
    </anomaly>
    <anomaly type="anomalous" value="1.677890,1.386490,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="83.96.75.36" src_port="1091" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1204520625"/>
        <to usec="0" sec="1204520671"/>
    </anomaly>
    <anomaly type="anomalous" value="1.670960,1.360250,999,0 0 0 1 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="164.232.171.237" src_port="9600"/>
        </slice>
        <from usec="0" sec="1204520400"/>
        <to usec="0" sec="1204521228"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713877,0.931222,999,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="169.3.9.165" dst_ip="153.253.212.252" src_port="25"/>
        </slice>
        <from usec="0" sec="1204520941"/>
        <to usec="0" sec="1204520946"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713877,0.931222,999,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="41.41.64.244" dst_ip="197.33.211.34" src_port="1712" dst_port="8080"/>
        </slice>
        <from usec="0" sec="1204520731"/>
        <to usec="0" sec="1204520741"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713877,0.931222,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="71.48.131.160" dst_ip="153.253.86.14" src_port="80"/>
        </slice>
        <from usec="0" sec="1204521131"/>
        <to usec="0" sec="1204521135"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713877,0.931222,503,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="208.145.119.11" dst_ip="153.253.67.17" dst_port="80"/>
        </slice>
        <from usec="0" sec="1204521145"/>
        <to usec="0" sec="1204521149"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713877,0.931222,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="71.48.131.188" dst_ip="153.253.86.14" src_port="80"/>
        </slice>
        <from usec="0" sec="1204521095"/>
        <to usec="0" sec="1204521233"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713877,0.931222,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="153.253.208.67" dst_ip="38.231.123.144" src_port="1444" dst_port="80"/>
        </slice>
        <from usec="0" sec="1204520744"/>
        <to usec="0" sec="1204520841"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713877,0.931222,999,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="214.29.161.226" dst_ip="156.103.29.29" src_port="1935" dst_port="2149"/>
        </slice>
        <from usec="0" sec="1204520408"/>
        <to usec="0" sec="1204521251"/>
    </anomaly>
    <anomaly type="suspicious" value="0.697435,0.891689,503,1 1 0 1 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="153.253.25.104" dst_port="80"/>
        </slice>
        <from usec="0" sec="1204520404"/>
        <to usec="0" sec="1204521296"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713877,0.931222,999,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="153.253.81.231" dst_ip="214.29.71.6" src_port="1991" dst_port="995"/>
        </slice>
        <from usec="0" sec="1204520498"/>
        <to usec="0" sec="1204520501"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713877,0.931222,502,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="164.232.169.47" dst_ip="214.241.204.253" src_port="34067" dst_port="22"/>
        </slice>
        <from usec="0" sec="1204520404"/>
        <to usec="0" sec="1204521293"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713877,0.931222,999,1 1 0 0 0 0 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="192.35.127.229" dst_ip="221.248.60.103" src_port="23" dst_port="2175"/>
        </slice>
        <from usec="0" sec="1204521047"/>
        <to usec="0" sec="1204521050"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713877,0.931222,503,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="196.25.147.85" dst_ip="38.203.87.248" src_port="1415" dst_port="80"/>
            <filter src_ip="196.25.147.85" dst_ip="38.203.87.248" src_port="1315" dst_port="80"/>
        </slice>
        <from usec="0" sec="1204520657"/>
        <to usec="0" sec="1204521267"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713877,0.931222,503,1 1 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="153.253.244.86" dst_ip="214.29.53.160" dst_port="80"/>
            <filter src_ip="153.253.244.86" dst_ip="215.32.246.74" dst_port="80"/>
        </slice>
        <from usec="0" sec="1204520508"/>
        <to usec="0" sec="1204521019"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713877,0.931222,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="153.253.21.49" dst_ip="38.214.94.192" dst_port="80"/>
        </slice>
        <from usec="0" sec="1204520400"/>
        <to usec="0" sec="1204521205"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713877,0.931222,503,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="196.145.35.217" dst_ip="164.232.196.54" src_port="80"/>
        </slice>
        <from usec="0" sec="1204521041"/>
        <to usec="0" sec="1204521066"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713877,0.931222,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="131.66.217.191" dst_ip="222.235.20.134" src_port="1750" dst_port="80"/>
        </slice>
        <from usec="0" sec="1204521131"/>
        <to usec="0" sec="1204521226"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713877,0.931222,503,1 1 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="164.232.198.72" dst_ip="214.29.51.161" dst_port="80"/>
            <filter src_ip="164.232.198.72" dst_ip="215.32.246.84" dst_port="80"/>
        </slice>
        <from usec="0" sec="1204520411"/>
        <to usec="0" sec="1204520512"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713877,0.931222,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="153.253.10.17" dst_ip="38.231.126.23" src_port="2121" dst_port="80"/>
        </slice>
        <from usec="0" sec="1204521200"/>
        <to usec="0" sec="1204521286"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713877,0.931222,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="215.1.32.77" dst_ip="164.232.171.225" src_port="80" dst_port="1193"/>
        </slice>
        <from usec="0" sec="1204520657"/>
        <to usec="0" sec="1204520773"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713877,0.931222,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="38.231.124.163" dst_ip="164.232.208.19" src_port="80" dst_port="1372"/>
        </slice>
        <from usec="0" sec="1204520741"/>
        <to usec="0" sec="1204520803"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713877,0.931222,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="153.253.10.24" dst_ip="35.147.49.138" src_port="3291" dst_port="80"/>
        </slice>
        <from usec="0" sec="1204520551"/>
        <to usec="0" sec="1204520803"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713877,0.931222,999,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="214.29.71.4" dst_ip="197.33.208.153" src_port="995" dst_port="1524"/>
        </slice>
        <from usec="0" sec="1204520404"/>
        <to usec="0" sec="1204520855"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713877,0.931222,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="153.253.237.168" dst_ip="38.184.94.76" src_port="59359" dst_port="80"/>
        </slice>
        <from usec="0" sec="1204520667"/>
        <to usec="0" sec="1204520952"/>
    </anomaly>
    <anomaly type="suspicious" value="0.697435,0.891689,999,1 1 0 1 0 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="214.29.71.6" src_port="995"/>
            <filter dst_ip="156.103.144.55" src_port="80"/>
        </slice>
        <from usec="0" sec="1204520421"/>
        <to usec="0" sec="1204521233"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713877,0.931222,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="153.253.116.245" dst_ip="38.231.127.68" src_port="2177" dst_port="80"/>
        </slice>
        <from usec="0" sec="1204520657"/>
        <to usec="0" sec="1204520795"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713877,0.931222,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="200.171.35.89" dst_ip="153.253.4.58" src_port="80" dst_port="1057"/>
        </slice>
        <from usec="0" sec="1204521215"/>
        <to usec="0" sec="1204521299"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713877,0.931222,999,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="156.103.29.29" dst_ip="214.29.161.226" src_port="2149" dst_port="1935"/>
        </slice>
        <from usec="0" sec="1204520414"/>
        <to usec="0" sec="1204521286"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713877,0.931222,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="164.232.193.171" dst_ip="205.71.110.150" src_port="1980" dst_port="80"/>
        </slice>
        <from usec="0" sec="1204520484"/>
        <to usec="0" sec="1204520746"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713877,0.931222,999,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="197.144.34.136" dst_ip="153.253.14.185" src_port="1935" dst_port="1384"/>
        </slice>
        <from usec="0" sec="1204520655"/>
        <to usec="0" sec="1204520743"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713877,0.931222,999,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="197.144.34.135" dst_ip="164.232.98.87" src_port="1935" dst_port="1432"/>
        </slice>
        <from usec="0" sec="1204520605"/>
        <to usec="0" sec="1204520610"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713877,0.931222,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="215.1.32.174" dst_ip="164.232.171.225" src_port="80" dst_port="1215"/>
        </slice>
        <from usec="0" sec="1204520953"/>
        <to usec="0" sec="1204521264"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713877,0.931222,999,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="58.102.196.112" dst_ip="197.33.220.85" src_port="2042" dst_port="8080"/>
        </slice>
        <from usec="0" sec="1204520414"/>
        <to usec="0" sec="1204520417"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713877,0.931222,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="164.232.47.151" dst_ip="215.38.244.212" dst_port="80"/>
        </slice>
        <from usec="0" sec="1204521127"/>
        <to usec="0" sec="1204521296"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713877,0.931222,503,1 1 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="197.33.221.82" dst_port="80"/>
        </slice>
        <from usec="0" sec="1204521043"/>
        <to usec="0" sec="1204521299"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713877,0.931222,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="215.16.144.120" dst_ip="196.16.216.178" src_port="80" dst_port="1056"/>
        </slice>
        <from usec="0" sec="1204520794"/>
        <to usec="0" sec="1204521132"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713877,0.931222,999,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="214.29.33.102" dst_ip="197.33.208.185" src_port="14917" dst_port="995"/>
        </slice>
        <from usec="0" sec="1204520564"/>
        <to usec="0" sec="1204520569"/>
    </anomaly>
    <anomaly type="suspicious" value="0.697435,0.891689,999,1 1 0 1 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="164.232.11.136" dst_port="995"/>
            <filter src_ip="51.8.61.46" dst_ip="164.232.11.136" dst_port="993"/>
        </slice>
        <from usec="0" sec="1204520400"/>
        <to usec="0" sec="1204521252"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713877,0.931222,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="153.253.84.213" dst_ip="203.74.119.9" src_port="2702" dst_port="80"/>
        </slice>
        <from usec="0" sec="1204520657"/>
        <to usec="0" sec="1204520964"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713877,0.931222,999,1 1 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="153.253.14.185" dst_ip="197.144.34.137" src_port="1473" dst_port="1935"/>
            <filter src_ip="153.253.14.185" dst_ip="197.144.34.136" src_port="1384" dst_port="1935"/>
        </slice>
        <from usec="0" sec="1204520654"/>
        <to usec="0" sec="1204520884"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713877,0.931222,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="164.232.169.233" dst_ip="83.191.139.251" src_port="2005" dst_port="80"/>
        </slice>
        <from usec="0" sec="1204520571"/>
        <to usec="0" sec="1204520606"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713877,0.931222,999,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="192.24.74.172" dst_ip="153.253.106.82" src_port="1935" dst_port="1994"/>
        </slice>
        <from usec="0" sec="1204520568"/>
        <to usec="0" sec="1204520583"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713877,0.931222,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="37.134.194.140" dst_ip="156.103.96.179" src_port="17597" dst_port="80"/>
            <filter src_ip="37.134.194.140" dst_ip="156.103.96.179" src_port="17596" dst_port="80"/>
        </slice>
        <from usec="0" sec="1204520937"/>
        <to usec="0" sec="1204520946"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713877,0.931222,503,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="153.253.88.199" dst_ip="215.67.240.17" src_port="3560" dst_port="80"/>
        </slice>
        <from usec="0" sec="1204520433"/>
        <to usec="0" sec="1204520437"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713877,0.931222,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="213.84.39.3" dst_ip="197.33.208.157" dst_port="80"/>
        </slice>
        <from usec="0" sec="1204520689"/>
        <to usec="0" sec="1204521113"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713877,0.931222,999,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="45.202.252.74" dst_ip="164.232.11.245" src_port="6769" dst_port="25"/>
        </slice>
        <from usec="0" sec="1204520407"/>
        <to usec="0" sec="1204520621"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713877,0.931222,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="200.8.99.36" dst_ip="164.232.208.129" src_port="80"/>
        </slice>
        <from usec="0" sec="1204521232"/>
        <to usec="0" sec="1204521243"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713877,0.931222,503,1 1 0 0 0 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter dst_ip="197.33.222.152" src_port="53"/>
            <filter dst_ip="197.33.222.152" dst_port="53"/>
            <filter dst_ip="197.33.222.152" dst_port="80"/>
            <filter src_port="53" dst_port="53"/>
        </slice>
        <from usec="0" sec="1204521289"/>
        <to usec="0" sec="1204521293"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713877,0.931222,503,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="212.214.68.115" dst_ip="153.253.95.18" src_port="80"/>
        </slice>
        <from usec="0" sec="1204521091"/>
        <to usec="0" sec="1204521180"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713877,0.931222,503,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="196.241.103.169" dst_ip="156.103.118.189" src_port="2826" dst_port="80"/>
            <filter src_ip="196.241.103.169" dst_ip="156.103.118.189" src_port="2681" dst_port="80"/>
            <filter src_ip="196.241.103.169" dst_ip="156.103.118.189" src_port="2623" dst_port="80"/>
        </slice>
        <from usec="0" sec="1204520432"/>
        <to usec="0" sec="1204520437"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713877,0.931222,503,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="164.232.173.188" dst_ip="45.195.10.96" dst_port="80"/>
        </slice>
        <from usec="0" sec="1204521276"/>
        <to usec="0" sec="1204521286"/>
    </anomaly>
    <anomaly type="suspicious" value="0.697435,0.891689,503,1 1 0 1 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="164.232.198.180" dst_ip="113.190.206.233" dst_port="80"/>
            <filter src_ip="164.232.198.180" dst_ip="38.18.170.196" dst_port="80"/>
        </slice>
        <from usec="0" sec="1204520432"/>
        <to usec="0" sec="1204520552"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713877,0.931222,503,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="164.232.129.35" dst_ip="36.255.189.116" dst_port="80"/>
        </slice>
        <from usec="0" sec="1204521249"/>
        <to usec="0" sec="1204521267"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713877,0.931222,503,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="196.25.97.233" dst_ip="212.116.176.24" dst_port="80"/>
        </slice>
        <from usec="0" sec="1204521145"/>
        <to usec="0" sec="1204521148"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713877,0.931222,503,1 1 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="153.253.69.149" dst_ip="36.31.53.249" src_port="33083" dst_port="110"/>
            <filter src_ip="153.253.69.149" dst_ip="36.31.53.249" src_port="33021" dst_port="110"/>
            <filter src_ip="153.253.69.149" dst_ip="48.143.220.99" src_port="32894" dst_port="80"/>
            <filter src_ip="153.253.69.149" dst_ip="49.12.110.112" src_port="32933" dst_port="80"/>
        </slice>
        <from usec="0" sec="1204520448"/>
        <to usec="0" sec="1204521286"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713877,0.931222,503,1 1 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="164.232.195.232" dst_ip="48.40.173.4" src_port="63198" dst_port="80"/>
            <filter src_ip="164.232.195.232" dst_ip="48.40.173.4" src_port="63197" dst_port="80"/>
            <filter src_ip="164.232.195.232" dst_ip="48.40.173.4" src_port="63195" dst_port="80"/>
            <filter src_ip="164.232.195.232" dst_ip="48.40.173.4" src_port="63194" dst_port="80"/>
            <filter src_ip="164.232.195.232" dst_ip="208.228.134.154" src_port="63200" dst_port="80"/>
        </slice>
        <from usec="0" sec="1204520579"/>
        <to usec="0" sec="1204520587"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713877,0.931222,503,1 1 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="156.161.173.236" dst_ip="201.40.140.64" dst_port="80"/>
            <filter src_ip="156.161.173.236" dst_ip="201.40.140.66" dst_port="80"/>
        </slice>
        <from usec="0" sec="1204520426"/>
        <to usec="0" sec="1204520496"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713877,0.931222,503,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="153.253.77.40" dst_ip="215.133.146.252" dst_port="80"/>
        </slice>
        <from usec="0" sec="1204520574"/>
        <to usec="0" sec="1204520583"/>
    </anomaly>
    <anomaly type="suspicious" value="0.697435,0.891689,503,1 1 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="196.25.105.18" dst_ip="71.32.175.208" dst_port="80"/>
        </slice>
        <from usec="0" sec="1204520524"/>
        <to usec="0" sec="1204520997"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713877,0.931222,503,1 1 0 0 0 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="32.134.2.131" dst_ip="153.253.233.185" dst_port="80"/>
            <filter src_ip="0.132.78.127" dst_ip="153.253.233.185" dst_port="80"/>
            <filter src_ip="0.183.187.104" dst_ip="153.253.233.185" dst_port="80"/>
        </slice>
        <from usec="0" sec="1204520674"/>
        <to usec="0" sec="1204520703"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713877,0.931222,999,1 1 0 0 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="156.103.129.30" src_port="25"/>
            <filter dst_ip="156.103.129.30" dst_port="25"/>
        </slice>
        <from usec="0" sec="1204520422"/>
        <to usec="0" sec="1204521293"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713877,0.931222,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="196.25.106.36" dst_ip="221.20.211.190" dst_port="80"/>
        </slice>
        <from usec="0" sec="1204521016"/>
        <to usec="0" sec="1204521293"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713877,0.931222,503,1 1 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="164.232.17.69" dst_port="80"/>
        </slice>
        <from usec="0" sec="1204520438"/>
        <to usec="0" sec="1204521166"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713877,0.931222,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="82.227.189.34" dst_port="139"/>
        </slice>
        <from usec="0" sec="1204520465"/>
        <to usec="0" sec="1204520493"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713877,0.931222,503,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="164.232.55.155" dst_ip="105.63.100.210" src_port="58728" dst_port="80"/>
        </slice>
        <from usec="0" sec="1204520816"/>
        <to usec="0" sec="1204520820"/>
    </anomaly>
    <anomaly type="suspicious" value="0.697435,0.891689,503,1 1 0 1 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="153.253.202.53" dst_ip="113.177.170.155" src_port="49249" dst_port="8102"/>
            <filter src_ip="153.253.202.53" dst_ip="36.183.4.49" src_port="50286" dst_port="80"/>
        </slice>
        <from usec="0" sec="1204520400"/>
        <to usec="0" sec="1204520567"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713877,0.931222,011,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="223.38.40.87" src_port="25"/>
        </slice>
        <from usec="0" sec="1204520420"/>
        <to usec="0" sec="1204520424"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713877,0.931222,503,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="164.232.213.38" dst_ip="215.233.148.9" src_port="49575" dst_port="80"/>
            <filter src_ip="164.232.213.38" dst_ip="215.233.148.9" src_port="49574" dst_port="80"/>
            <filter src_ip="164.232.213.38" dst_ip="215.233.148.9" src_port="49573" dst_port="80"/>
            <filter src_ip="164.232.213.38" dst_ip="215.233.148.9" src_port="49572" dst_port="80"/>
        </slice>
        <from usec="0" sec="1204521229"/>
        <to usec="0" sec="1204521233"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713877,0.931222,503,1 1 0 0 0 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="196.145.35.102" dst_ip="153.253.88.24" src_port="80" dst_port="1586"/>
            <filter src_ip="196.145.35.102" dst_ip="153.253.88.24" src_port="80" dst_port="1585"/>
            <filter src_ip="169.18.237.229" dst_ip="153.253.88.24" src_port="80" dst_port="1593"/>
            <filter src_ip="169.18.237.229" dst_ip="153.253.88.24" src_port="80" dst_port="1592"/>
            <filter src_ip="195.48.115.2" dst_ip="153.253.88.24" src_port="80" dst_port="1594"/>
        </slice>
        <from usec="0" sec="1204520501"/>
        <to usec="0" sec="1204520505"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713877,0.931222,011,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="84.179.5.22" dst_port="80"/>
        </slice>
        <from usec="0" sec="1204521279"/>
        <to usec="0" sec="1204521293"/>
    </anomaly>
    <anomaly type="suspicious" value="0.697435,0.891689,999,1 1 0 1 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="153.253.115.230" dst_port="25"/>
        </slice>
        <from usec="0" sec="1204520424"/>
        <to usec="0" sec="1204521203"/>
    </anomaly>
    <anomaly type="suspicious" value="0.697435,0.891689,999,1 1 0 1 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="153.253.212.252" dst_port="25"/>
        </slice>
        <from usec="0" sec="1204520402"/>
        <to usec="0" sec="1204521224"/>
    </anomaly>
    <anomaly type="suspicious" value="0.697435,0.891689,503,1 1 0 1 0 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="84.247.69.71" dst_port="80"/>
            <filter dst_ip="197.33.221.125" dst_port="80"/>
        </slice>
        <from usec="0" sec="1204520400"/>
        <to usec="0" sec="1204521260"/>
    </anomaly>
    <anomaly type="suspicious" value="0.697435,0.891689,503,1 1 0 1 0 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="153.253.89.42" dst_port="80"/>
            <filter dst_ip="215.67.240.21" dst_port="80"/>
            <filter dst_ip="197.46.58.197" dst_port="80"/>
        </slice>
        <from usec="0" sec="1204520402"/>
        <to usec="0" sec="1204521296"/>
    </anomaly>
    <anomaly type="suspicious" value="0.849109,0.944209,503,1 0 0 1 1 0 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="164.232.98.87" dst_ip="46.89.137.176" dst_port="80"/>
        </slice>
        <from usec="0" sec="1204520420"/>
        <to usec="0" sec="1204520956"/>
    </anomaly>
    <anomaly type="suspicious" value="0.697435,0.891689,999,1 1 0 1 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="164.232.11.136" dst_ip="51.8.61.46" src_port="993"/>
            <filter src_ip="164.232.11.136" dst_ip="37.208.53.77" src_port="995"/>
        </slice>
        <from usec="0" sec="1204520400"/>
        <to usec="0" sec="1204521260"/>
    </anomaly>
    <anomaly type="suspicious" value="0.849414,0.969554,503,0 0 0 1 1 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="5.202.81.173" dst_ip="164.232.55.40" src_port="80" dst_port="2006"/>
        </slice>
        <from usec="0" sec="1204520659"/>
        <to usec="0" sec="1204520662"/>
    </anomaly>
    <anomaly type="suspicious" value="0.697435,0.891689,503,1 1 0 1 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="221.25.177.139" dst_port="80"/>
        </slice>
        <from usec="0" sec="1204520400"/>
        <to usec="0" sec="1204521206"/>
    </anomaly>
    <anomaly type="suspicious" value="0.849109,0.944209,503,1 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="155.150.250.52" dst_ip="164.232.8.145" dst_port="80"/>
        </slice>
        <from usec="0" sec="1204520503"/>
        <to usec="0" sec="1204520618"/>
    </anomaly>
    <anomaly type="suspicious" value="0.849109,0.944209,503,1 0 0 1 1 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="196.25.105.16" dst_ip="220.54.229.220" dst_port="80"/>
        </slice>
        <from usec="0" sec="1204520537"/>
        <to usec="0" sec="1204521286"/>
    </anomaly>
    <anomaly type="suspicious" value="0.849109,0.944209,999,1 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="221.25.184.3" dst_ip="153.253.30.201" src_port="40786" dst_port="995"/>
        </slice>
        <from usec="0" sec="1204520809"/>
        <to usec="0" sec="1204520838"/>
    </anomaly>
    <anomaly type="suspicious" value="0.697435,0.891689,503,1 1 0 1 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="153.253.184.220" dst_port="80"/>
            <filter src_ip="153.253.188.182" dst_port="80"/>
        </slice>
        <from usec="0" sec="1204520400"/>
        <to usec="0" sec="1204521260"/>
    </anomaly>
    <anomaly type="suspicious" value="0.849414,0.969554,999,0 0 0 1 1 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="153.253.134.26" dst_port="25"/>
        </slice>
        <from usec="0" sec="1204520400"/>
        <to usec="0" sec="1204521136"/>
    </anomaly>
    <anomaly type="suspicious" value="0.697435,0.891689,503,1 1 0 1 0 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="196.16.216.178" dst_port="80"/>
            <filter dst_ip="195.48.115.2" dst_port="80"/>
        </slice>
        <from usec="0" sec="1204520400"/>
        <to usec="0" sec="1204521212"/>
    </anomaly>
    <anomaly type="suspicious" value="0.849109,0.944209,503,1 0 0 1 1 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="45.30.8.108" dst_port="80"/>
            <filter dst_ip="196.25.145.105" dst_port="80"/>
        </slice>
        <from usec="0" sec="1204520424"/>
        <to usec="0" sec="1204521228"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713877,0.931222,999,1 1 0 0 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="214.29.32.50" dst_port="995"/>
        </slice>
        <from usec="0" sec="1204520462"/>
        <to usec="0" sec="1204520591"/>
    </anomaly>
    <anomaly type="suspicious" value="0.849414,0.969554,503,0 0 0 1 1 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="214.29.51.161" dst_ip="164.232.35.78" src_port="80"/>
            <filter src_ip="214.29.51.161" dst_ip="197.33.208.153" src_port="80"/>
        </slice>
        <from usec="0" sec="1204520400"/>
        <to usec="0" sec="1204520688"/>
    </anomaly>
    <anomaly type="suspicious" value="0.849414,0.969554,501,0 0 0 1 1 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="222.100.147.215" dst_ip="153.253.218.39" src_port="62587" dst_port="21"/>
            <filter src_ip="222.100.147.215" dst_ip="153.253.218.39" src_port="58551" dst_port="21"/>
        </slice>
        <from usec="0" sec="1204520400"/>
        <to usec="0" sec="1204520778"/>
    </anomaly>
    <anomaly type="suspicious" value="0.849414,0.969554,501,0 0 0 1 1 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="222.100.147.215" dst_ip="153.253.149.102" src_port="40921" dst_port="21"/>
        </slice>
        <from usec="0" sec="1204520400"/>
        <to usec="0" sec="1204520508"/>
    </anomaly>
    <anomaly type="suspicious" value="0.849414,0.969554,999,0 0 0 1 1 0 0 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="197.33.218.24" dst_port="53"/>
        </slice>
        <from usec="0" sec="1204520400"/>
        <to usec="0" sec="1204520598"/>
    </anomaly>
    <anomaly type="suspicious" value="0.849414,0.969554,501,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="222.100.147.215" dst_ip="153.253.144.94" src_port="47845" dst_port="21"/>
        </slice>
        <from usec="0" sec="1204520400"/>
        <to usec="0" sec="1204520589"/>
    </anomaly>
    <anomaly type="suspicious" value="0.849414,0.969554,504,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="221.80.205.72" dst_ip="153.253.20.31" src_port="443"/>
        </slice>
        <from usec="0" sec="1204520400"/>
        <to usec="0" sec="1204520866"/>
    </anomaly>
    <anomaly type="suspicious" value="0.849414,0.969554,010,0 0 0 1 1 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="172.20.32.65"/>
        </slice>
        <from usec="0" sec="1204520400"/>
        <to usec="0" sec="1204520597"/>
    </anomaly>
    <anomaly type="suspicious" value="0.849414,0.969554,503,0 0 0 1 1 0 0 0 0 0 0 0,point_to_point">
        <slice>
            <filter src_ip="71.48.161.216" dst_ip="156.103.129.72" src_port="53143" dst_port="80"/>
            <filter src_ip="71.48.161.216" dst_ip="156.103.129.72" src_port="48440" dst_port="80"/>
            <filter src_ip="71.48.161.216" dst_ip="156.103.129.72" src_port="43928" dst_port="80"/>
        </slice>
        <from usec="0" sec="1204520470"/>
        <to usec="0" sec="1204520579"/>
    </anomaly>
    <anomaly type="suspicious" value="0.849414,0.969554,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="153.253.197.56" dst_ip="38.152.66.180" dst_port="80"/>
        </slice>
        <from usec="0" sec="1204520400"/>
        <to usec="0" sec="1204520524"/>
    </anomaly>
    <anomaly type="suspicious" value="0.849414,0.969554,999,0 0 0 1 1 0 0 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="196.16.228.112" dst_port="53"/>
        </slice>
        <from usec="0" sec="1204520400"/>
        <to usec="0" sec="1204520688"/>
    </anomaly>
    <anomaly type="suspicious" value="0.849414,0.969554,504,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="156.103.129.28" dst_ip="197.47.18.231" src_port="443"/>
        </slice>
        <from usec="0" sec="1204520402"/>
        <to usec="0" sec="1204520678"/>
    </anomaly>
    <anomaly type="suspicious" value="0.862966,1.006030,503,0 0 0 0 1 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="217.74.150.215"/>
        </slice>
        <from usec="0" sec="1204520484"/>
        <to usec="0" sec="1204520559"/>
    </anomaly>
    <anomaly type="suspicious" value="0.849414,0.969554,503,0 0 0 1 1 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="196.53.78.109" dst_ip="34.56.41.254" src_port="80" dst_port="2381"/>
        </slice>
        <from usec="0" sec="1204520656"/>
        <to usec="0" sec="1204520678"/>
    </anomaly>
    <anomaly type="suspicious" value="0.849414,0.969554,503,0 0 0 1 1 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="197.69.123.142" dst_ip="164.232.203.71" src_port="80"/>
            <filter src_ip="197.69.123.140" dst_ip="164.232.203.71" src_port="80"/>
        </slice>
        <from usec="0" sec="1204520508"/>
        <to usec="0" sec="1204520774"/>
    </anomaly>
    <anomaly type="suspicious" value="0.849414,0.969554,999,0 0 0 1 1 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="197.33.208.160" src_port="37637" dst_port="53"/>
        </slice>
        <from usec="0" sec="1204520546"/>
        <to usec="0" sec="1204520648"/>
    </anomaly>
    <anomaly type="suspicious" value="0.849109,0.944209,999,1 0 0 1 1 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="197.33.212.100" src_port="6970"/>
            <filter src_ip="197.33.212.100" dst_ip="35.40.107.97" dst_port="8080"/>
        </slice>
        <from usec="0" sec="1204520400"/>
        <to usec="0" sec="1204520868"/>
    </anomaly>
    <anomaly type="suspicious" value="0.849414,0.969554,503,0 0 0 1 1 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="196.145.33.86" dst_ip="153.253.208.13" src_port="80"/>
            <filter src_ip="195.48.115.2" dst_ip="153.253.208.13" src_port="80"/>
        </slice>
        <from usec="0" sec="1204520506"/>
        <to usec="0" sec="1204520768"/>
    </anomaly>
    <anomaly type="suspicious" value="0.849414,0.969554,999,0 0 0 1 1 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="218.96.183.11" src_port="2284" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1204520400"/>
        <to usec="0" sec="1204521048"/>
    </anomaly>
    <anomaly type="suspicious" value="0.849414,0.969554,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="153.253.144.206" dst_ip="154.156.66.172" dst_port="80"/>
        </slice>
        <from usec="0" sec="1204520403"/>
        <to usec="0" sec="1204521031"/>
    </anomaly>
    <anomaly type="suspicious" value="0.849414,0.969554,999,0 0 0 1 1 0 0 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="156.161.186.2" dst_port="1942"/>
        </slice>
        <from usec="0" sec="1204520400"/>
        <to usec="0" sec="1204521138"/>
    </anomaly>
    <anomaly type="suspicious" value="0.849414,0.969554,999,0 0 0 1 1 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="63.185.202.104" dst_ip="197.33.211.34" dst_port="3127"/>
            <filter src_ip="63.185.202.104" dst_ip="197.33.211.45" dst_port="3124"/>
        </slice>
        <from usec="0" sec="1204520409"/>
        <to usec="0" sec="1204521138"/>
    </anomaly>
    <anomaly type="suspicious" value="0.849414,0.969554,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="153.253.14.178" dst_ip="154.75.219.140" dst_port="80"/>
        </slice>
        <from usec="0" sec="1204520706"/>
        <to usec="0" sec="1204521131"/>
    </anomaly>
    <anomaly type="suspicious" value="0.849414,0.969554,503,0 0 0 1 1 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="196.53.78.109" dst_ip="45.89.80.200" src_port="80" dst_port="4710"/>
        </slice>
        <from usec="0" sec="1204520971"/>
        <to usec="0" sec="1204521000"/>
    </anomaly>
    <anomaly type="suspicious" value="0.849414,0.969554,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="217.31.15.86" dst_ip="153.253.116.179" src_port="80" dst_port="2843"/>
        </slice>
        <from usec="0" sec="1204521121"/>
        <to usec="0" sec="1204521133"/>
    </anomaly>
    <anomaly type="suspicious" value="0.849414,0.969554,503,0 0 0 1 1 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="152.65.147.239" dst_ip="36.56.2.224" src_port="80"/>
            <filter src_ip="164.232.102.64" dst_ip="36.56.2.224" src_port="80"/>
        </slice>
        <from usec="0" sec="1204520407"/>
        <to usec="0" sec="1204521216"/>
    </anomaly>
    <anomaly type="suspicious" value="0.849414,0.969554,503,0 0 0 1 1 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="215.1.32.4" dst_ip="164.232.169.193" src_port="80" dst_port="4944"/>
        </slice>
        <from usec="0" sec="1204520922"/>
        <to usec="0" sec="1204521052"/>
    </anomaly>
    <anomaly type="suspicious" value="0.849414,0.969554,503,0 0 0 1 1 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="153.253.107.180" dst_ip="40.1.157.181" dst_port="80"/>
            <filter src_ip="153.253.107.180" dst_ip="32.173.169.13" dst_port="80"/>
        </slice>
        <from usec="0" sec="1204520923"/>
        <to usec="0" sec="1204521210"/>
    </anomaly>
    <anomaly type="suspicious" value="0.849414,0.969554,503,0 0 0 1 1 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="36.75.84.213" dst_ip="153.253.188.232" src_port="80"/>
            <filter src_ip="45.208.54.4" dst_ip="153.253.188.232" src_port="80"/>
            <filter src_ip="154.75.219.141" dst_ip="153.253.188.232" src_port="80"/>
        </slice>
        <from usec="0" sec="1204521135"/>
        <to usec="0" sec="1204521228"/>
    </anomaly>
    <anomaly type="suspicious" value="0.938411,1.024730,010,0 0 0 0 0 0 1 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="196.229.157.59" src_port="80"/>
        </slice>
        <from usec="0" sec="1204520625"/>
        <to usec="0" sec="1204520671"/>
    </anomaly>
    <anomaly type="suspicious" value="0.849414,0.969554,010,0 0 0 1 1 0 0 0 0 0 0 0,sptpDoSSYN">
        <slice>
            <filter src_ip="197.33.221.20" dst_ip="59.133.221.203" dst_port="25"/>
        </slice>
        <from usec="0" sec="1204520401"/>
        <to usec="0" sec="1204521136"/>
    </anomaly>
    <anomaly type="suspicious" value="0.938411,1.024730,010,0 0 0 0 0 0 1 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="5.36.9.208" src_port="80" dst_port="61234"/>
        </slice>
        <from usec="0" sec="1204520760"/>
        <to usec="0" sec="1204520806"/>
    </anomaly>
    <anomaly type="suspicious" value="0.938411,1.024730,020,0 0 0 0 0 0 1 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="50.85.67.121"/>
        </slice>
        <from usec="0" sec="1204520760"/>
        <to usec="0" sec="1204520806"/>
    </anomaly>
    <anomaly type="suspicious" value="0.938411,1.024730,999,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="197.33.198.76"/>
        </slice>
        <from usec="0" sec="1204520760"/>
        <to usec="0" sec="1204520806"/>
    </anomaly>
    <anomaly type="suspicious" value="0.938411,1.024730,999,0 0 0 0 0 0 1 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="218.188.77.182" dst_ip="164.232.94.121"/>
            <filter src_ip="218.188.77.182" dst_ip="197.33.211.45"/>
            <filter src_ip="218.188.77.182" dst_ip="197.33.211.44"/>
            <filter src_ip="218.188.77.182" dst_port="3124"/>
            <filter src_ip="218.188.77.182" dst_port="3127"/>
            <filter src_ip="218.188.77.182" dst_port="3128"/>
            <filter dst_ip="164.232.94.121" dst_port="3124"/>
            <filter dst_ip="164.232.94.121" dst_port="3127"/>
            <filter dst_ip="197.33.211.45" dst_port="3124"/>
            <filter dst_ip="197.33.211.45" dst_port="3127"/>
            <filter dst_ip="197.33.211.44" dst_port="3127"/>
            <filter dst_ip="197.33.211.44" dst_port="3128"/>
        </slice>
        <from usec="0" sec="1204521075"/>
        <to usec="0" sec="1204521121"/>
    </anomaly>
    <anomaly type="suspicious" value="0.938411,1.024730,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="156.103.145.40"/>
        </slice>
        <from usec="0" sec="1204521255"/>
        <to usec="0" sec="1204521301"/>
    </anomaly>
    <anomaly type="suspicious" value="0.938411,1.024730,999,0 0 0 0 0 0 1 0 0 0 0 0,heavy_hitter">
        <slice>
            <filter src_ip="46.104.165.123" dst_ip="197.33.211.34"/>
        </slice>
        <from usec="0" sec="1204521255"/>
        <to usec="0" sec="1204521301"/>
    </anomaly>
    <anomaly type="suspicious" value="0.938411,1.024730,010,0 0 0 0 0 0 1 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="84.179.5.22" src_port="80"/>
        </slice>
        <from usec="0" sec="1204521255"/>
        <to usec="0" sec="1204521301"/>
    </anomaly>
    <anomaly type="suspicious" value="0.938135,1.000780,503,1 0 0 0 0 0 1 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="212.167.54.37" dst_ip="164.232.196.7" src_port="80"/>
        </slice>
        <from usec="0" sec="1204521255"/>
        <to usec="0" sec="1204521301"/>
    </anomaly>
    <anomaly type="suspicious" value="0.697435,0.891689,999,1 1 0 1 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="164.232.94.120" dst_port="3124"/>
        </slice>
        <from usec="0" sec="1204520402"/>
        <to usec="0" sec="1204521243"/>
    </anomaly>
</admd:annotation>
