<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="anomalous" value="1.111090,1.000810,999,1 0 0 1 0 0 1 1 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="160.188.216.58" dst_port="25"/>
            <filter src_ip="167.209.53.45" dst_port="25"/>
            <filter dst_ip="101.226.193.124" dst_port="25"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207286031"/>
    </anomaly>
    <anomaly type="anomalous" value="1.685600,1.277390,999,1 1 0 1 1 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="212.205.237.46" dst_port="3128"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207286060"/>
    </anomaly>
    <anomaly type="anomalous" value="1.521500,1.199890,503,1 1 0 1 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter dst_ip="212.205.227.45" dst_port="21"/>
            <filter dst_ip="160.86.89.211" dst_port="80"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207286089"/>
    </anomaly>
    <anomaly type="anomalous" value="1.685600,1.277390,999,1 1 0 1 1 0 1 1 1 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="74.112.118.8" dst_ip="149.82.92.83"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207286060"/>
    </anomaly>
    <anomaly type="anomalous" value="1.077320,1.037220,503,1 1 0 1 1 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="212.205.238.12" dst_port="80"/>
        </slice>
        <from usec="0" sec="1207285201"/>
        <to usec="0" sec="1207286093"/>
    </anomaly>
    <anomaly type="anomalous" value="2.345390,1.866430,999,1 1 1 1 1 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_ip="212.205.237.46"/>
            <filter src_port="3128"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207286100"/>
    </anomaly>
    <anomaly type="anomalous" value="1.685600,1.277390,999,1 1 0 1 1 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_ip="160.86.89.169" src_port="25"/>
            <filter src_ip="160.86.89.169" dst_port="25"/>
            <filter src_ip="167.209.66.244" dst_port="25"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207286093"/>
    </anomaly>
    <anomaly type="anomalous" value="2.345390,1.866430,503,1 1 1 1 1 0 1 1 1 0 0 0,ntscACK">
        <slice>
            <filter src_ip="213.61.69.95" dst_port="80"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207286093"/>
    </anomaly>
    <anomaly type="anomalous" value="2.345390,1.866430,503,1 1 1 1 1 0 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="197.126.137.73" dst_port="80"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207286058"/>
    </anomaly>
    <anomaly type="anomalous" value="2.345390,1.866430,999,1 1 1 1 1 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_ip="160.86.89.175"/>
            <filter dst_port="53"/>
            <filter src_ip="213.61.121.139" dst_ip="198.21.166.186" dst_port="80"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207286100"/>
    </anomaly>
    <anomaly type="anomalous" value="2.365030,2.004900,503,1 1 0 1 1 1 1 1 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="144.106.71.119" dst_port="80"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207286052"/>
    </anomaly>
    <anomaly type="anomalous" value="1.077320,1.037220,503,1 1 0 1 1 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="167.209.178.22" dst_ip="204.156.110.208" dst_port="80"/>
        </slice>
        <from usec="0" sec="1207285597"/>
        <to usec="0" sec="1207286094"/>
    </anomaly>
    <anomaly type="anomalous" value="1.521500,1.199890,999,1 1 0 1 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="213.61.69.7" dst_port="25"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207285953"/>
    </anomaly>
    <anomaly type="anomalous" value="1.077320,1.037220,503,1 1 0 1 1 0 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="167.209.133.18" dst_ip="48.49.67.197" dst_port="80"/>
        </slice>
        <from usec="0" sec="1207285309"/>
        <to usec="0" sec="1207286070"/>
    </anomaly>
    <anomaly type="anomalous" value="2.985980,2.476650,999,1 1 1 1 1 1 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="192.85.162.208" dst_port="1026"/>
            <filter src_ip="192.85.162.208" dst_port="1027"/>
        </slice>
        <from usec="0" sec="1207285209"/>
        <to usec="0" sec="1207286028"/>
    </anomaly>
    <anomaly type="anomalous" value="1.954540,1.711040,503,1 1 1 1 1 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="149.82.211.221" dst_port="80"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207286080"/>
    </anomaly>
    <anomaly type="anomalous" value="1.814920,1.653980,503,1 1 1 1 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="212.205.229.106" dst_port="80"/>
            <filter dst_ip="212.205.229.106" dst_port="21"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207286100"/>
    </anomaly>
    <anomaly type="anomalous" value="1.077320,1.037220,999,1 1 0 1 1 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="160.188.216.50" dst_port="25"/>
            <filter dst_ip="160.188.216.50" src_port="53" dst_port="65160"/>
        </slice>
        <from usec="0" sec="1207285209"/>
        <to usec="0" sec="1207286093"/>
    </anomaly>
    <anomaly type="anomalous" value="1.063230,1.034820,010,1 1 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="196.221.243.29" dst_port="4899"/>
        </slice>
        <from usec="0" sec="1207285380"/>
        <to usec="0" sec="1207286101"/>
    </anomaly>
    <anomaly type="anomalous" value="1.098220,1.074980,503,1 1 0 0 1 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="167.209.96.206" dst_port="80"/>
            <filter src_ip="167.209.8.17" dst_ip="204.157.157.138" dst_port="80"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207286082"/>
    </anomaly>
    <anomaly type="anomalous" value="1.827410,1.677920,503,1 1 1 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="167.209.208.54" src_port="25"/>
            <filter src_ip="167.209.208.54" dst_port="25"/>
            <filter src_ip="167.209.208.54" dst_ip="221.92.33.242" dst_port="80"/>
        </slice>
        <from usec="0" sec="1207286026"/>
        <to usec="0" sec="1207286029"/>
    </anomaly>
    <anomaly type="anomalous" value="1.709410,1.624700,503,1 0 1 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="167.209.178.185" dst_port="80"/>
        </slice>
        <from usec="0" sec="1207285468"/>
        <to usec="0" sec="1207285551"/>
    </anomaly>
    <anomaly type="anomalous" value="1.827410,1.677920,503,1 1 1 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="77.44.137.35" dst_ip="167.209.184.53" dst_port="80"/>
        </slice>
        <from usec="0" sec="1207285956"/>
        <to usec="0" sec="1207285987"/>
    </anomaly>
    <anomaly type="anomalous" value="2.066600,1.742110,010,1 1 1 1 1 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="213.45.167.148" dst_port="135"/>
        </slice>
        <from usec="0" sec="1207285445"/>
        <to usec="0" sec="1207286066"/>
    </anomaly>
    <anomaly type="anomalous" value="1.954540,1.711040,503,1 1 1 1 1 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="204.157.220.98" dst_ip="167.209.90.89" dst_port="80"/>
            <filter src_ip="101.207.93.49" dst_ip="167.209.90.89" dst_port="80"/>
        </slice>
        <from usec="0" sec="1207285659"/>
        <to usec="0" sec="1207286022"/>
    </anomaly>
    <anomaly type="anomalous" value="1.827410,1.677920,503,1 1 1 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="167.209.88.93" dst_ip="200.204.12.154" dst_port="80"/>
        </slice>
        <from usec="0" sec="1207286090"/>
        <to usec="0" sec="1207286096"/>
    </anomaly>
    <anomaly type="anomalous" value="1.827410,1.677920,503,1 1 1 0 0 0 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="13.10.237.138" dst_ip="160.86.171.167" src_port="80" dst_port="1095"/>
            <filter src_ip="13.10.237.138" dst_ip="160.86.171.167" src_port="80" dst_port="1087"/>
        </slice>
        <from usec="0" sec="1207285878"/>
        <to usec="0" sec="1207285881"/>
    </anomaly>
    <anomaly type="anomalous" value="1.954540,1.711040,999,1 1 1 1 1 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="167.209.222.216" dst_ip="106.134.112.22" src_port="1038" dst_port="6669"/>
            <filter src_ip="167.209.222.216" dst_ip="96.195.37.74" src_port="17772" dst_port="1024"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207285403"/>
    </anomaly>
    <anomaly type="anomalous" value="2.030100,1.891240,503,0 0 0 1 1 1 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="167.209.168.206" dst_ip="100.112.53.145" src_port="80"/>
            <filter src_ip="167.209.168.206" dst_ip="100.112.53.156" src_port="80"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207285755"/>
    </anomaly>
    <anomaly type="anomalous" value="1.556890,1.206630,999,1 0 0 1 1 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="149.82.92.83" src_port="15000"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207286093"/>
    </anomaly>
    <anomaly type="anomalous" value="2.230380,1.814270,503,1 1 1 1 0 0 1 1 1 0 0 0,ntscACK">
        <slice>
            <filter src_ip="167.209.172.56" dst_port="80"/>
        </slice>
        <from usec="0" sec="1207285201"/>
        <to usec="0" sec="1207286100"/>
    </anomaly>
    <anomaly type="anomalous" value="1.059910,1.049900,501,0 1 0 1 1 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="201.81.230.92" dst_ip="212.205.227.45" dst_port="21"/>
            <filter src_ip="197.217.12.83" dst_ip="212.205.227.45" dst_port="21"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207285981"/>
    </anomaly>
    <anomaly type="anomalous" value="1.824070,1.633150,999,1 0 1 1 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="212.205.224.179" dst_port="46992"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207286025"/>
    </anomaly>
    <anomaly type="anomalous" value="1.059910,1.049900,999,0 1 0 1 1 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="167.209.88.92" dst_ip="213.166.57.140"/>
            <filter src_ip="167.209.88.92" dst_port="80"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207285791"/>
    </anomaly>
    <anomaly type="anomalous" value="1.077320,1.037220,503,1 1 0 1 1 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="167.209.195.66" dst_port="80"/>
        </slice>
        <from usec="0" sec="1207285260"/>
        <to usec="0" sec="1207285480"/>
    </anomaly>
    <anomaly type="anomalous" value="1.041620,0.995546,503,1 1 0 1 0 0 1 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="167.209.208.5" dst_ip="8.194.107.32" dst_port="80"/>
            <filter src_ip="167.209.208.5" dst_ip="8.194.107.32" dst_port="20480"/>
        </slice>
        <from usec="0" sec="1207285202"/>
        <to usec="0" sec="1207286028"/>
    </anomaly>
    <anomaly type="anomalous" value="2.039240,1.884230,503,1 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="212.192.9.161" dst_ip="167.209.14.53" src_port="80"/>
        </slice>
        <from usec="0" sec="1207285210"/>
        <to usec="0" sec="1207285736"/>
    </anomaly>
    <anomaly type="anomalous" value="1.521500,1.199890,999,1 1 0 1 0 0 1 1 1 0 0 0,alphfl">
        <slice>
            <filter src_ip="104.33.94.1" dst_ip="212.205.237.32" dst_port="3124"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207286056"/>
    </anomaly>
    <anomaly type="anomalous" value="2.039240,1.884230,503,1 0 0 1 1 1 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="160.86.88.4" src_port="80"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207286028"/>
    </anomaly>
    <anomaly type="anomalous" value="1.075490,1.016760,503,0 0 0 1 1 0 1 0 0 0 0 0,mptmp">
        <slice>
            <filter src_port="80"/>
            <filter dst_ip="160.86.157.128" dst_port="38480"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207285847"/>
    </anomaly>
    <anomaly type="anomalous" value="1.269340,1.087710,999,1 1 0 1 1 0 1 0 0 0 0 0,mptmp">
        <slice>
            <filter dst_ip="160.86.89.169" src_port="25"/>
            <filter dst_ip="160.86.89.169" dst_port="25"/>
            <filter dst_ip="167.209.66.244" src_port="25"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207286084"/>
    </anomaly>
    <anomaly type="anomalous" value="2.030100,1.891240,503,0 0 0 1 1 1 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="167.209.20.224" dst_port="53709"/>
            <filter src_ip="213.60.29.252" dst_ip="167.209.20.224" src_port="80"/>
        </slice>
        <from usec="0" sec="1207285226"/>
        <to usec="0" sec="1207285572"/>
    </anomaly>
    <anomaly type="anomalous" value="1.556890,1.206630,999,1 0 0 1 1 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="213.238.226.209" src_port="53"/>
        </slice>
        <from usec="0" sec="1207285201"/>
        <to usec="0" sec="1207285741"/>
    </anomaly>
    <anomaly type="anomalous" value="2.039240,1.884230,503,1 0 0 1 1 1 0 0 0 0 0 0,point_to_point">
        <slice>
            <filter src_ip="68.224.39.151" dst_ip="160.68.128.149" src_port="80"/>
        </slice>
        <from usec="0" sec="1207285201"/>
        <to usec="0" sec="1207286023"/>
    </anomaly>
    <anomaly type="anomalous" value="1.363970,1.135970,503,0 0 0 1 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter dst_ip="167.209.20.168" src_port="80"/>
            <filter src_ip="75.50.12.96" dst_ip="167.209.20.164" src_port="80"/>
        </slice>
        <from usec="0" sec="1207285209"/>
        <to usec="0" sec="1207285932"/>
    </anomaly>
    <anomaly type="anomalous" value="1.556890,1.206630,999,1 0 0 1 1 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="192.85.162.208" dst_port="1027"/>
        </slice>
        <from usec="0" sec="1207285619"/>
        <to usec="0" sec="1207285758"/>
    </anomaly>
    <anomaly type="anomalous" value="1.077320,1.037220,503,1 1 0 1 1 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="212.205.238.12" src_port="80"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207286096"/>
    </anomaly>
    <anomaly type="anomalous" value="1.685600,1.277390,999,1 1 0 1 1 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="216.246.213.197" src_port="53"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207286057"/>
    </anomaly>
    <anomaly type="anomalous" value="2.139120,1.930310,503,1 1 0 1 1 1 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="106.145.136.39" src_port="80"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207285938"/>
    </anomaly>
    <anomaly type="anomalous" value="1.077320,1.037220,503,1 1 0 1 1 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="212.205.229.106" src_port="80"/>
            <filter src_ip="212.205.229.106" src_port="21"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207286050"/>
    </anomaly>
    <anomaly type="anomalous" value="1.556890,1.206630,999,1 0 0 1 1 0 1 1 1 0 0 0,ntscACK">
        <slice>
            <filter src_ip="212.205.237.46" src_port="3128"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207286094"/>
    </anomaly>
    <anomaly type="anomalous" value="1.114810,1.052540,503,0 0 0 0 0 0 1 1 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="75.50.17.91" dst_ip="167.209.182.82" src_port="80"/>
            <filter src_ip="75.50.17.91" dst_ip="167.209.178.70" src_port="80"/>
        </slice>
        <from usec="0" sec="1207285695"/>
        <to usec="0" sec="1207285741"/>
    </anomaly>
    <anomaly type="anomalous" value="2.345390,1.866430,999,1 1 1 1 1 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="216.246.213.197" dst_port="53"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207286100"/>
    </anomaly>
    <anomaly type="anomalous" value="1.077320,1.037220,503,1 1 0 1 1 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="160.130.108.24" dst_port="80"/>
            <filter dst_ip="165.64.188.133" dst_port="80"/>
        </slice>
        <from usec="0" sec="1207285208"/>
        <to usec="0" sec="1207286100"/>
    </anomaly>
    <anomaly type="anomalous" value="2.345390,1.866430,020,1 1 1 1 1 0 1 1 1 0 0 0,ntscICec">
        <slice>
            <filter src_ip="212.205.238.94"/>
        </slice>
        <from usec="0" sec="1207285220"/>
        <to usec="0" sec="1207285987"/>
    </anomaly>
    <anomaly type="anomalous" value="2.985980,2.476650,010,1 1 1 1 1 1 1 1 1 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="78.183.3.55" src_port="6000" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207286019"/>
    </anomaly>
    <anomaly type="anomalous" value="2.030100,1.891240,501,0 0 0 1 1 1 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="185.129.74.120" dst_ip="101.207.71.75" src_port="80"/>
            <filter src_ip="185.129.74.120" dst_ip="101.207.71.75" src_port="21"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207285938"/>
    </anomaly>
    <anomaly type="anomalous" value="1.075490,1.016760,503,0 0 0 1 1 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="144.106.71.119" src_port="80"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207285938"/>
    </anomaly>
    <anomaly type="anomalous" value="2.030100,1.891240,504,0 0 0 1 1 1 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="149.130.123.219" dst_ip="167.209.165.113" src_port="443"/>
        </slice>
        <from usec="0" sec="1207285375"/>
        <to usec="0" sec="1207285417"/>
    </anomaly>
    <anomaly type="anomalous" value="2.030100,1.891240,503,0 0 0 1 1 1 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="160.68.128.144" src_port="80"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207285488"/>
    </anomaly>
    <anomaly type="anomalous" value="2.030100,1.891240,503,0 0 0 1 1 1 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="167.209.90.89" dst_ip="74.113.65.67" src_port="80"/>
            <filter src_ip="167.209.90.89" dst_ip="100.112.34.37" src_port="80"/>
            <filter src_ip="160.86.89.211" dst_ip="74.113.65.67" src_port="80"/>
        </slice>
        <from usec="0" sec="1207285203"/>
        <to usec="0" sec="1207285466"/>
    </anomaly>
    <anomaly type="anomalous" value="1.098220,1.074980,999,1 1 0 0 1 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="167.209.210.251" dst_port="25"/>
        </slice>
        <from usec="0" sec="1207285438"/>
        <to usec="0" sec="1207285601"/>
    </anomaly>
    <anomaly type="anomalous" value="1.075490,1.016760,503,0 0 0 1 1 0 1 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="14.219.56.110" dst_ip="213.61.69.95" src_port="80"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207285932"/>
    </anomaly>
    <anomaly type="anomalous" value="1.544890,1.217550,503,0 0 0 1 1 0 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="14.218.93.232" src_port="80"/>
        </slice>
        <from usec="0" sec="1207285335"/>
        <to usec="0" sec="1207285572"/>
    </anomaly>
    <anomaly type="anomalous" value="2.030100,1.891240,503,0 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="207.97.33.6" dst_ip="167.209.20.224" src_port="80" dst_port="2894"/>
        </slice>
        <from usec="0" sec="1207285594"/>
        <to usec="0" sec="1207285668"/>
    </anomaly>
    <anomaly type="anomalous" value="2.030100,1.891240,503,0 0 0 1 1 1 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="48.49.67.197" dst_ip="167.209.133.18" src_port="80"/>
        </slice>
        <from usec="0" sec="1207285309"/>
        <to usec="0" sec="1207285668"/>
    </anomaly>
    <anomaly type="anomalous" value="2.030100,1.891240,503,0 0 0 1 1 1 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="75.108.145.147" dst_ip="149.82.93.8" src_port="80" dst_port="50320"/>
            <filter src_ip="75.108.145.142" dst_ip="149.82.93.8" src_port="80" dst_port="50232"/>
            <filter src_ip="75.108.145.141" dst_ip="149.82.93.8" src_port="80" dst_port="50190"/>
            <filter src_ip="75.108.145.131" dst_ip="149.82.93.8" src_port="80" dst_port="50280"/>
        </slice>
        <from usec="0" sec="1207285481"/>
        <to usec="0" sec="1207285680"/>
    </anomaly>
    <anomaly type="anomalous" value="2.030100,1.891240,503,0 0 0 1 1 1 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="106.145.172.3" dst_port="80"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207286028"/>
    </anomaly>
    <anomaly type="anomalous" value="1.063230,1.034820,020,1 1 0 0 0 0 1 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="117.202.254.193"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207285520"/>
    </anomaly>
    <anomaly type="anomalous" value="1.094220,1.013940,503,0 0 0 1 0 0 1 1 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="196.111.12.95" dst_ip="167.209.185.134" src_port="80"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207285667"/>
    </anomaly>
    <anomaly type="anomalous" value="1.521500,1.199890,503,1 1 0 1 0 0 1 1 1 0 0 0,ntscACK">
        <slice>
            <filter src_ip="167.209.46.157" src_port="52025"/>
            <filter src_ip="167.209.46.157" dst_port="80"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207286073"/>
    </anomaly>
    <anomaly type="anomalous" value="1.363970,1.135970,999,0 0 0 1 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="212.205.224.179" src_port="46992"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207286028"/>
    </anomaly>
    <anomaly type="anomalous" value="1.312850,1.104570,999,0 0 0 1 1 0 1 1 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="160.86.157.128" src_port="38480"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207285668"/>
    </anomaly>
    <anomaly type="anomalous" value="1.363970,1.135970,503,0 0 0 1 0 0 1 1 1 0 0 0,ntscACK">
        <slice>
            <filter src_ip="149.82.211.221" src_port="80"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207285758"/>
    </anomaly>
    <anomaly type="anomalous" value="1.114810,1.052540,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="196.187.213.146" src_port="3040" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1207285335"/>
        <to usec="0" sec="1207285381"/>
    </anomaly>
    <anomaly type="anomalous" value="1.536380,1.232670,010,1 1 0 0 0 0 1 1 1 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="196.68.151.226" dst_port="445"/>
            <filter src_ip="196.68.151.226" dst_port="139"/>
        </slice>
        <from usec="0" sec="1207285335"/>
        <to usec="0" sec="1207285382"/>
    </anomaly>
    <anomaly type="anomalous" value="1.544890,1.217550,503,0 0 0 1 1 0 1 1 1 0 0 0,heavy_hitter">
        <slice>
            <filter src_ip="198.21.166.186" dst_ip="144.106.71.119" src_port="80"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207286028"/>
    </anomaly>
    <anomaly type="anomalous" value="1.521500,1.199890,999,1 1 0 1 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="213.61.121.54" src_port="20129"/>
            <filter src_ip="213.61.121.54" src_port="11994"/>
            <filter src_ip="149.82.5.152" src_port="20129" dst_port="20129"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207286075"/>
    </anomaly>
    <anomaly type="anomalous" value="2.230380,1.814270,010,1 1 1 1 0 0 1 1 1 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="193.79.16.234" dst_port="139"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207286101"/>
    </anomaly>
    <anomaly type="anomalous" value="1.393960,1.159190,010,1 0 0 0 0 0 1 1 1 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="201.39.126.63" dst_port="80"/>
        </slice>
        <from usec="0" sec="1207285335"/>
        <to usec="0" sec="1207285741"/>
    </anomaly>
    <anomaly type="anomalous" value="1.393960,1.159190,010,1 0 0 0 0 0 1 1 1 0 0 0,ptpDoSSYN">
        <slice>
            <filter src_ip="212.133.3.87" dst_ip="212.205.227.210" dst_port="22"/>
        </slice>
        <from usec="0" sec="1207285232"/>
        <to usec="0" sec="1207286077"/>
    </anomaly>
    <anomaly type="anomalous" value="2.230380,1.814270,999,1 1 1 1 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="192.85.162.225" src_port="32857" dst_port="1026"/>
            <filter src_ip="192.85.162.225" src_port="32857" dst_port="1027"/>
        </slice>
        <from usec="0" sec="1207285695"/>
        <to usec="0" sec="1207285741"/>
    </anomaly>
    <anomaly type="anomalous" value="1.380550,1.170540,010,0 0 0 0 0 0 1 1 1 0 0 0,heavy_hitter">
        <slice>
            <filter src_ip="160.67.228.10" dst_ip="145.218.137.214" src_port="80"/>
        </slice>
        <from usec="0" sec="1207285650"/>
        <to usec="0" sec="1207285741"/>
    </anomaly>
    <anomaly type="anomalous" value="1.393960,1.159190,002,1 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="207.175.38.186" src_port="1028" dst_port="137"/>
        </slice>
        <from usec="0" sec="1207285695"/>
        <to usec="0" sec="1207285741"/>
    </anomaly>
    <anomaly type="anomalous" value="1.363970,1.135970,999,0 0 0 1 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="68.241.32.147" src_port="2868" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1207285210"/>
        <to usec="0" sec="1207286028"/>
    </anomaly>
    <anomaly type="anomalous" value="1.380550,1.170540,999,0 0 0 0 0 0 1 1 1 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="74.112.118.8" dst_ip="149.82.92.83"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207285246"/>
    </anomaly>
    <anomaly type="anomalous" value="1.114810,1.052540,020,0 0 0 0 0 0 1 1 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="112.231.98.94"/>
        </slice>
        <from usec="0" sec="1207285335"/>
        <to usec="0" sec="1207285381"/>
    </anomaly>
    <anomaly type="anomalous" value="1.114810,1.052540,503,0 0 0 0 0 0 1 1 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="14.218.135.222" dst_ip="167.209.88.92" src_port="80"/>
        </slice>
        <from usec="0" sec="1207285335"/>
        <to usec="0" sec="1207285381"/>
    </anomaly>
    <anomaly type="anomalous" value="1.699040,1.308230,010,1 1 0 0 1 0 1 1 1 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="77.195.150.215" dst_port="25"/>
        </slice>
        <from usec="0" sec="1207285201"/>
        <to usec="0" sec="1207286102"/>
    </anomaly>
    <anomaly type="anomalous" value="1.380550,1.170540,503,0 0 0 0 0 0 1 1 1 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="149.82.22.172" dst_ip="103.213.112.252" dst_port="80"/>
            <filter src_ip="149.82.22.172" dst_ip="103.213.112.244" dst_port="80"/>
        </slice>
        <from usec="0" sec="1207285335"/>
        <to usec="0" sec="1207285741"/>
    </anomaly>
    <anomaly type="anomalous" value="1.114810,1.052540,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="14.49.45.189" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1207285335"/>
        <to usec="0" sec="1207285381"/>
    </anomaly>
    <anomaly type="anomalous" value="1.114810,1.052540,503,0 0 0 0 0 0 1 1 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="213.196.247.105" dst_ip="167.209.169.7" src_port="80"/>
        </slice>
        <from usec="0" sec="1207285335"/>
        <to usec="0" sec="1207285381"/>
    </anomaly>
    <anomaly type="anomalous" value="1.114810,1.052540,010,0 0 0 0 0 0 1 1 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="196.68.151.226" dst_port="139"/>
        </slice>
        <from usec="0" sec="1207285335"/>
        <to usec="0" sec="1207285381"/>
    </anomaly>
    <anomaly type="anomalous" value="1.380550,1.170540,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="193.114.158.240" src_port="1515" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1207285335"/>
        <to usec="0" sec="1207285381"/>
    </anomaly>
    <anomaly type="anomalous" value="1.380550,1.170540,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="197.218.210.254" src_port="2090" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1207285335"/>
        <to usec="0" sec="1207285381"/>
    </anomaly>
    <anomaly type="anomalous" value="1.380550,1.170540,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="196.186.54.178" src_port="2593" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1207285335"/>
        <to usec="0" sec="1207285381"/>
    </anomaly>
    <anomaly type="anomalous" value="1.380550,1.170540,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="196.129.40.100" src_port="1048" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1207285335"/>
        <to usec="0" sec="1207285381"/>
    </anomaly>
    <anomaly type="anomalous" value="1.380550,1.170540,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="213.130.217.213" src_port="3891" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1207285335"/>
        <to usec="0" sec="1207285381"/>
    </anomaly>
    <anomaly type="anomalous" value="1.380550,1.170540,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="170.28.42.235" src_port="4405" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1207285335"/>
        <to usec="0" sec="1207285381"/>
    </anomaly>
    <anomaly type="anomalous" value="1.380550,1.170540,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="192.201.27.168" src_port="1043" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1207285335"/>
        <to usec="0" sec="1207285381"/>
    </anomaly>
    <anomaly type="anomalous" value="1.380550,1.170540,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="78.177.101.122" src_port="1313" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1207285335"/>
        <to usec="0" sec="1207285381"/>
    </anomaly>
    <anomaly type="anomalous" value="1.380550,1.170540,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="212.74.10.88" src_port="1083" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1207285335"/>
        <to usec="0" sec="1207285381"/>
    </anomaly>
    <anomaly type="anomalous" value="1.380550,1.170540,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="14.4.234.151" src_port="3115" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1207285335"/>
        <to usec="0" sec="1207285381"/>
    </anomaly>
    <anomaly type="anomalous" value="1.380550,1.170540,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="216.227.155.100" src_port="6667"/>
        </slice>
        <from usec="0" sec="1207285695"/>
        <to usec="0" sec="1207285741"/>
    </anomaly>
    <anomaly type="anomalous" value="1.380550,1.170540,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="192.85.162.235" src_port="35245" dst_port="1026"/>
            <filter src_ip="192.85.162.235" src_port="35245" dst_port="1027"/>
        </slice>
        <from usec="0" sec="1207285695"/>
        <to usec="0" sec="1207285741"/>
    </anomaly>
    <anomaly type="anomalous" value="1.380550,1.170540,020,0 0 0 0 0 0 1 1 1 0 0 0,icmp_error">
        <slice>
            <filter src_ip="213.61.101.60"/>
        </slice>
        <from usec="0" sec="1207285695"/>
        <to usec="0" sec="1207285741"/>
    </anomaly>
    <anomaly type="anomalous" value="1.380550,1.170540,020,0 0 0 0 0 0 1 1 1 0 0 0,ntscICec">
        <slice>
            <filter src_ip="112.231.98.94"/>
        </slice>
        <from usec="0" sec="1207285695"/>
        <to usec="0" sec="1207285741"/>
    </anomaly>
    <anomaly type="anomalous" value="1.094220,1.013940,999,0 0 0 1 0 0 1 1 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="212.205.227.193" src_port="31077"/>
            <filter src_ip="212.205.227.193" src_port="3731"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207285755"/>
    </anomaly>
    <anomaly type="anomalous" value="1.380550,1.170540,999,0 0 0 0 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_ip="194.23.230.236" dst_port="3128"/>
            <filter src_ip="101.92.255.87" dst_port="3124"/>
            <filter src_ip="101.92.255.87" dst_port="3128"/>
            <filter dst_ip="212.205.237.47" dst_port="3128"/>
            <filter src_ip="194.23.230.236" dst_ip="212.205.237.47" dst_port="3124"/>
            <filter src_ip="194.23.230.236" dst_ip="212.205.237.46" dst_port="3124"/>
        </slice>
        <from usec="0" sec="1207285335"/>
        <to usec="0" sec="1207285741"/>
    </anomaly>
    <anomaly type="anomalous" value="1.380550,1.170540,002,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="120.146.180.222" src_port="57271" dst_port="137"/>
        </slice>
        <from usec="0" sec="1207285695"/>
        <to usec="0" sec="1207285741"/>
    </anomaly>
    <anomaly type="anomalous" value="1.380550,1.170540,011,0 0 0 0 0 0 1 1 1 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="193.100.134.25" dst_ip="160.199.201.214" src_port="80"/>
            <filter src_ip="193.100.134.25" dst_ip="160.199.136.142" src_port="80"/>
            <filter src_ip="193.100.134.25" dst_ip="160.188.8.86" src_port="80"/>
        </slice>
        <from usec="0" sec="1207285695"/>
        <to usec="0" sec="1207285741"/>
    </anomaly>
    <anomaly type="anomalous" value="1.380550,1.170540,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="160.86.194.33" dst_port="53"/>
        </slice>
        <from usec="0" sec="1207285695"/>
        <to usec="0" sec="1207285741"/>
    </anomaly>
    <anomaly type="anomalous" value="1.380550,1.170540,010,0 0 0 0 0 0 1 1 1 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="9.237.89.172" dst_port="139"/>
        </slice>
        <from usec="0" sec="1207285695"/>
        <to usec="0" sec="1207285741"/>
    </anomaly>
    <anomaly type="anomalous" value="1.380550,1.170540,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="14.18.194.92" src_port="2885" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1207285695"/>
        <to usec="0" sec="1207285741"/>
    </anomaly>
    <anomaly type="anomalous" value="1.380550,1.170540,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="196.187.213.146" src_port="3040" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1207285695"/>
        <to usec="0" sec="1207285741"/>
    </anomaly>
    <anomaly type="anomalous" value="1.380550,1.170540,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="196.129.40.100" src_port="1048" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1207285695"/>
        <to usec="0" sec="1207285741"/>
    </anomaly>
    <anomaly type="anomalous" value="1.380550,1.170540,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="197.218.210.254" src_port="2090" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1207285695"/>
        <to usec="0" sec="1207285741"/>
    </anomaly>
    <anomaly type="anomalous" value="1.380550,1.170540,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="213.130.217.213" src_port="3891" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1207285695"/>
        <to usec="0" sec="1207285741"/>
    </anomaly>
    <anomaly type="anomalous" value="1.380550,1.170540,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="170.28.42.235" src_port="4405" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1207285695"/>
        <to usec="0" sec="1207285741"/>
    </anomaly>
    <anomaly type="anomalous" value="1.380550,1.170540,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="213.128.76.6" src_port="1161" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1207285695"/>
        <to usec="0" sec="1207285741"/>
    </anomaly>
    <anomaly type="anomalous" value="1.380550,1.170540,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="193.114.158.240" src_port="1515" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1207285695"/>
        <to usec="0" sec="1207285741"/>
    </anomaly>
    <anomaly type="anomalous" value="1.380550,1.170540,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="192.201.27.168" src_port="1043" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1207285695"/>
        <to usec="0" sec="1207285741"/>
    </anomaly>
    <anomaly type="anomalous" value="1.380550,1.170540,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="78.177.101.122" src_port="1313" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1207285695"/>
        <to usec="0" sec="1207285741"/>
    </anomaly>
    <anomaly type="anomalous" value="1.380550,1.170540,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="212.74.10.88" src_port="1083" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1207285695"/>
        <to usec="0" sec="1207285741"/>
    </anomaly>
    <anomaly type="anomalous" value="1.380550,1.170540,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="196.186.54.178" src_port="2593" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1207285695"/>
        <to usec="0" sec="1207285741"/>
    </anomaly>
    <anomaly type="anomalous" value="1.380550,1.170540,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="14.4.234.151" src_port="3115" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1207285695"/>
        <to usec="0" sec="1207285741"/>
    </anomaly>
    <anomaly type="anomalous" value="1.380550,1.170540,503,0 0 0 0 0 0 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="14.218.93.232" src_port="80"/>
        </slice>
        <from usec="0" sec="1207285695"/>
        <to usec="0" sec="1207285786"/>
    </anomaly>
    <anomaly type="anomalous" value="1.096440,1.055250,999,0 0 0 0 1 0 1 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="9.194.165.216" dst_ip="212.205.237.33" dst_port="3124"/>
            <filter src_ip="9.194.165.216" dst_ip="212.205.237.32" dst_port="3124"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207286022"/>
    </anomaly>
    <anomaly type="anomalous" value="1.380550,1.170540,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="213.128.76.6" src_port="1161" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1207285335"/>
        <to usec="0" sec="1207285381"/>
    </anomaly>
    <anomaly type="anomalous" value="1.380550,1.170540,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="68.241.32.147" src_port="2868" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1207285335"/>
        <to usec="0" sec="1207285381"/>
    </anomaly>
    <anomaly type="anomalous" value="1.380550,1.170540,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="14.18.194.92" src_port="2885" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1207285335"/>
        <to usec="0" sec="1207285381"/>
    </anomaly>
    <anomaly type="anomalous" value="1.380550,1.170540,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="213.61.106.210" src_port="65534" dst_port="53"/>
        </slice>
        <from usec="0" sec="1207285695"/>
        <to usec="0" sec="1207285741"/>
    </anomaly>
    <anomaly type="anomalous" value="1.380550,1.170540,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="216.227.155.97" src_port="6667"/>
        </slice>
        <from usec="0" sec="1207285695"/>
        <to usec="0" sec="1207285741"/>
    </anomaly>
    <anomaly type="anomalous" value="1.380550,1.170540,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="160.188.216.155" src_port="63789"/>
        </slice>
        <from usec="0" sec="1207285335"/>
        <to usec="0" sec="1207285741"/>
    </anomaly>
    <anomaly type="anomalous" value="1.380550,1.170540,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="160.188.216.50" src_port="25"/>
        </slice>
        <from usec="0" sec="1207285695"/>
        <to usec="0" sec="1207285741"/>
    </anomaly>
    <anomaly type="anomalous" value="1.380550,1.170540,503,0 0 0 0 0 0 1 1 1 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="212.248.168.175" dst_ip="167.209.213.68" src_port="80"/>
        </slice>
        <from usec="0" sec="1207285695"/>
        <to usec="0" sec="1207285741"/>
    </anomaly>
    <anomaly type="anomalous" value="1.380550,1.170540,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="14.49.45.189" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1207285695"/>
        <to usec="0" sec="1207285741"/>
    </anomaly>
    <anomaly type="anomalous" value="1.094220,1.013940,999,0 0 0 1 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="160.86.89.228" src_port="45442" dst_port="53"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207285847"/>
    </anomaly>
    <anomaly type="suspicious" value="0.801640,0.995005,999,0 1 0 0 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="144.106.70.116" dst_ip="106.145.148.151" src_port="51226" dst_port="25"/>
            <filter src_ip="144.106.70.116" dst_ip="106.145.148.151" src_port="51183" dst_port="25"/>
            <filter src_ip="144.106.70.116" dst_ip="106.145.148.151" src_port="51182" dst_port="25"/>
            <filter src_ip="149.82.162.98" dst_ip="106.145.148.151" src_port="63796" dst_port="25"/>
            <filter src_ip="149.82.162.98" dst_ip="106.145.148.151" src_port="63793" dst_port="25"/>
        </slice>
        <from usec="0" sec="1207285713"/>
        <to usec="0" sec="1207285716"/>
    </anomaly>
    <anomaly type="suspicious" value="0.796457,0.940121,503,1 1 0 1 0 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter dst_ip="167.209.168.194" dst_port="80"/>
            <filter dst_ip="167.209.168.195" dst_port="80"/>
        </slice>
        <from usec="0" sec="1207285235"/>
        <to usec="0" sec="1207286075"/>
    </anomaly>
    <anomaly type="suspicious" value="0.824518,0.981620,053,1 1 0 0 0 0 0 0 0 0 0 0,point_to_point">
        <slice>
            <filter src_ip="198.232.6.139" dst_ip="167.209.128.250" src_port="80"/>
        </slice>
        <from usec="0" sec="1207285235"/>
        <to usec="0" sec="1207285909"/>
    </anomaly>
    <anomaly type="suspicious" value="0.862129,0.948718,503,1 0 0 1 1 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="103.147.154.183" src_port="80"/>
            <filter dst_ip="167.209.178.185" src_port="80"/>
        </slice>
        <from usec="0" sec="1207285328"/>
        <to usec="0" sec="1207285679"/>
    </anomaly>
    <anomaly type="suspicious" value="0.824518,0.981620,503,1 1 0 0 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="167.209.145.21" src_port="80"/>
        </slice>
        <from usec="0" sec="1207285339"/>
        <to usec="0" sec="1207286034"/>
    </anomaly>
    <anomaly type="suspicious" value="0.824518,0.981620,503,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="104.87.145.206" dst_ip="167.209.145.21" src_port="80" dst_port="1088"/>
        </slice>
        <from usec="0" sec="1207285239"/>
        <to usec="0" sec="1207285243"/>
    </anomaly>
    <anomaly type="suspicious" value="0.796457,0.940121,503,1 1 0 1 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="149.82.211.221" src_port="80"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207286031"/>
    </anomaly>
    <anomaly type="suspicious" value="0.824518,0.981620,503,1 1 0 0 0 0 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="167.209.107.241" dst_ip="118.130.170.212" dst_port="80"/>
        </slice>
        <from usec="0" sec="1207285756"/>
        <to usec="0" sec="1207285762"/>
    </anomaly>
    <anomaly type="suspicious" value="0.824518,0.981620,503,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="167.209.122.129" dst_ip="103.162.132.118" dst_port="80"/>
        </slice>
        <from usec="0" sec="1207285238"/>
        <to usec="0" sec="1207285244"/>
    </anomaly>
    <anomaly type="suspicious" value="0.824518,0.981620,999,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="171.231.70.131" dst_ip="212.205.237.47" src_port="1588" dst_port="8080"/>
        </slice>
        <from usec="0" sec="1207285955"/>
        <to usec="0" sec="1207285958"/>
    </anomaly>
    <anomaly type="suspicious" value="0.824518,0.981620,503,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="149.82.92.80" dst_ip="192.74.211.185" dst_port="80"/>
        </slice>
        <from usec="0" sec="1207285213"/>
        <to usec="0" sec="1207286100"/>
    </anomaly>
    <anomaly type="suspicious" value="0.824518,0.981620,504,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="213.60.67.69" dst_ip="167.209.178.228" src_port="443"/>
        </slice>
        <from usec="0" sec="1207285266"/>
        <to usec="0" sec="1207285511"/>
    </anomaly>
    <anomaly type="suspicious" value="0.824518,0.981620,503,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="149.82.89.248" dst_ip="204.157.244.204" dst_port="80"/>
        </slice>
        <from usec="0" sec="1207285203"/>
        <to usec="0" sec="1207285973"/>
    </anomaly>
    <anomaly type="suspicious" value="0.824518,0.981620,999,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="167.209.133.108" dst_ip="192.24.241.13" src_port="4704" dst_port="554"/>
        </slice>
        <from usec="0" sec="1207285422"/>
        <to usec="0" sec="1207286096"/>
    </anomaly>
    <anomaly type="suspicious" value="0.824518,0.981620,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="167.209.84.241" dst_ip="102.34.111.182" src_port="3968" dst_port="80"/>
        </slice>
        <from usec="0" sec="1207285383"/>
        <to usec="0" sec="1207285475"/>
    </anomaly>
    <anomaly type="suspicious" value="0.824518,0.981620,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="102.34.99.162" dst_ip="150.183.2.252" src_port="80" dst_port="1808"/>
            <filter src_ip="102.34.99.162" dst_ip="150.183.2.252" src_port="80" dst_port="1805"/>
        </slice>
        <from usec="0" sec="1207286022"/>
        <to usec="0" sec="1207286061"/>
    </anomaly>
    <anomaly type="suspicious" value="0.824518,0.981620,999,1 1 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="167.209.210.251" dst_ip="68.84.152.143" src_port="25" dst_port="63551"/>
            <filter src_ip="167.209.210.251" dst_ip="8.191.98.210" src_port="25" dst_port="4048"/>
            <filter src_ip="167.209.210.251" dst_ip="12.245.76.3" src_port="25" dst_port="62655"/>
            <filter src_ip="167.209.210.251" dst_ip="198.76.195.80" src_port="58771" dst_port="25"/>
        </slice>
        <from usec="0" sec="1207285498"/>
        <to usec="0" sec="1207285502"/>
    </anomaly>
    <anomaly type="suspicious" value="0.824518,0.981620,999,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="204.43.36.140" dst_ip="144.106.35.190" src_port="38618" dst_port="25"/>
        </slice>
        <from usec="0" sec="1207285319"/>
        <to usec="0" sec="1207285572"/>
    </anomaly>
    <anomaly type="suspicious" value="0.824518,0.981620,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="197.118.1.133" dst_ip="167.209.188.224" src_port="80" dst_port="1067"/>
            <filter src_ip="197.118.1.133" dst_ip="167.209.188.224" src_port="80" dst_port="1066"/>
        </slice>
        <from usec="0" sec="1207285651"/>
        <to usec="0" sec="1207285655"/>
    </anomaly>
    <anomaly type="suspicious" value="0.824518,0.981620,999,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="167.209.133.11" dst_ip="192.24.241.9" src_port="4257" dst_port="554"/>
        </slice>
        <from usec="0" sec="1207285226"/>
        <to usec="0" sec="1207285766"/>
    </anomaly>
    <anomaly type="suspicious" value="0.824518,0.981620,503,1 1 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="167.209.115.147" dst_ip="204.119.97.186" dst_port="80"/>
            <filter src_ip="167.209.115.147" dst_ip="106.145.150.15" dst_port="80"/>
        </slice>
        <from usec="0" sec="1207285496"/>
        <to usec="0" sec="1207286032"/>
    </anomaly>
    <anomaly type="suspicious" value="0.824518,0.981620,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="197.23.111.93" dst_ip="167.209.169.2" dst_port="80"/>
        </slice>
        <from usec="0" sec="1207285448"/>
        <to usec="0" sec="1207285778"/>
    </anomaly>
    <anomaly type="suspicious" value="0.824518,0.981620,503,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="104.87.145.169" dst_ip="167.209.46.217" src_port="80" dst_port="52201"/>
        </slice>
        <from usec="0" sec="1207285220"/>
        <to usec="0" sec="1207285517"/>
    </anomaly>
    <anomaly type="suspicious" value="0.801640,0.995005,503,0 1 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="204.157.250.191" src_port="80"/>
        </slice>
        <from usec="0" sec="1207285203"/>
        <to usec="0" sec="1207286065"/>
    </anomaly>
    <anomaly type="suspicious" value="0.824518,0.981620,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="204.157.244.91" dst_ip="167.209.77.97" src_port="80"/>
        </slice>
        <from usec="0" sec="1207285941"/>
        <to usec="0" sec="1207286100"/>
    </anomaly>
    <anomaly type="suspicious" value="0.824518,0.981620,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="204.157.221.129" dst_ip="167.209.8.165" src_port="80"/>
        </slice>
        <from usec="0" sec="1207285203"/>
        <to usec="0" sec="1207286100"/>
    </anomaly>
    <anomaly type="suspicious" value="0.824518,0.981620,999,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="102.74.129.158" dst_ip="144.106.9.57" src_port="42693" dst_port="20"/>
        </slice>
        <from usec="0" sec="1207285251"/>
        <to usec="0" sec="1207285946"/>
    </anomaly>
    <anomaly type="suspicious" value="0.796457,0.940121,503,1 1 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="106.145.150.15" dst_ip="167.209.145.21" src_port="80"/>
        </slice>
        <from usec="0" sec="1207285202"/>
        <to usec="0" sec="1207285679"/>
    </anomaly>
    <anomaly type="suspicious" value="0.824518,0.981620,999,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="9.118.87.44" dst_ip="212.205.237.32" src_port="1061" dst_port="8080"/>
        </slice>
        <from usec="0" sec="1207285949"/>
        <to usec="0" sec="1207285962"/>
    </anomaly>
    <anomaly type="suspicious" value="0.824518,0.981620,999,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="212.82.100.153" dst_ip="167.209.78.113" src_port="1935" dst_port="2649"/>
        </slice>
        <from usec="0" sec="1207286000"/>
        <to usec="0" sec="1207286018"/>
    </anomaly>
    <anomaly type="suspicious" value="0.824518,0.981620,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="193.81.7.80" dst_ip="167.209.186.86" dst_port="80"/>
        </slice>
        <from usec="0" sec="1207285400"/>
        <to usec="0" sec="1207285549"/>
    </anomaly>
    <anomaly type="suspicious" value="0.824518,0.981620,999,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="77.42.84.225" dst_ip="167.209.193.9" src_port="3389" dst_port="1493"/>
        </slice>
        <from usec="0" sec="1207285201"/>
        <to usec="0" sec="1207286101"/>
    </anomaly>
    <anomaly type="suspicious" value="0.801640,0.995005,503,0 1 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="167.209.178.185" dst_port="80"/>
        </slice>
        <from usec="0" sec="1207285522"/>
        <to usec="0" sec="1207285551"/>
    </anomaly>
    <anomaly type="suspicious" value="0.824518,0.981620,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="100.112.53.145" dst_ip="167.209.168.206" src_port="38067" dst_port="80"/>
            <filter src_ip="100.112.53.145" dst_ip="167.209.168.206" src_port="38014" dst_port="80"/>
        </slice>
        <from usec="0" sec="1207285246"/>
        <to usec="0" sec="1207285250"/>
    </anomaly>
    <anomaly type="suspicious" value="0.824518,0.981620,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="160.86.52.137" dst_ip="14.24.27.19" src_port="1686" dst_port="80"/>
        </slice>
        <from usec="0" sec="1207285250"/>
        <to usec="0" sec="1207286013"/>
    </anomaly>
    <anomaly type="suspicious" value="0.824518,0.981620,503,1 1 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="167.209.199.160" dst_ip="100.247.162.40" dst_port="443"/>
            <filter src_ip="167.209.199.160" dst_ip="102.34.99.52" dst_port="80"/>
            <filter src_ip="167.209.199.160" dst_ip="205.8.150.28" dst_port="80"/>
        </slice>
        <from usec="0" sec="1207285374"/>
        <to usec="0" sec="1207285641"/>
    </anomaly>
    <anomaly type="suspicious" value="0.824518,0.981620,503,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="196.96.71.26" dst_ip="212.205.238.12" src_port="1456" dst_port="80"/>
        </slice>
        <from usec="0" sec="1207285787"/>
        <to usec="0" sec="1207285790"/>
    </anomaly>
    <anomaly type="suspicious" value="0.824518,0.981620,503,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="167.209.20.18" dst_ip="206.214.164.10" dst_port="80"/>
        </slice>
        <from usec="0" sec="1207286009"/>
        <to usec="0" sec="1207286036"/>
    </anomaly>
    <anomaly type="suspicious" value="0.824518,0.981620,503,1 1 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="167.209.191.16" dst_ip="220.222.237.188" src_port="3304" dst_port="80"/>
            <filter src_ip="167.209.191.16" dst_ip="220.222.234.172" src_port="3302" dst_port="80"/>
        </slice>
        <from usec="0" sec="1207285816"/>
        <to usec="0" sec="1207285820"/>
    </anomaly>
    <anomaly type="suspicious" value="0.824518,0.981620,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="102.34.96.195" dst_ip="167.209.20.232" src_port="80" dst_port="1143"/>
        </slice>
        <from usec="0" sec="1207285360"/>
        <to usec="0" sec="1207285470"/>
    </anomaly>
    <anomaly type="suspicious" value="0.824518,0.981620,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="166.25.214.157" dst_ip="52.88.241.11" src_port="8361" dst_port="80"/>
        </slice>
        <from usec="0" sec="1207285894"/>
        <to usec="0" sec="1207285897"/>
    </anomaly>
    <anomaly type="suspicious" value="0.824518,0.981620,503,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="117.200.216.182" dst_ip="212.205.237.46" src_port="55741" dst_port="80"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207285209"/>
    </anomaly>
    <anomaly type="suspicious" value="0.824518,0.981620,503,1 1 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="167.209.8.165" dst_ip="204.157.221.129" dst_port="80"/>
            <filter src_ip="167.209.8.165" dst_ip="111.40.166.147" dst_port="80"/>
        </slice>
        <from usec="0" sec="1207285341"/>
        <to usec="0" sec="1207286022"/>
    </anomaly>
    <anomaly type="suspicious" value="0.824518,0.981620,503,1 1 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="167.209.53.141" dst_ip="100.112.34.54" src_port="80"/>
            <filter src_ip="167.209.53.141" dst_ip="74.119.65.22" src_port="80"/>
        </slice>
        <from usec="0" sec="1207285353"/>
        <to usec="0" sec="1207285512"/>
    </anomaly>
    <anomaly type="suspicious" value="0.824518,0.981620,502,1 1 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="122.128.178.46" dst_ip="160.86.89.170" src_port="26185" dst_port="143"/>
            <filter src_ip="122.128.178.46" dst_ip="160.86.89.170" src_port="26108" dst_port="143"/>
            <filter src_ip="122.128.178.46" dst_ip="160.86.226.78" src_port="27549" dst_port="22"/>
            <filter src_ip="122.128.178.46" dst_ip="160.86.226.58" src_port="29925" dst_port="80"/>
        </slice>
        <from usec="0" sec="1207285210"/>
        <to usec="0" sec="1207285801"/>
    </anomaly>
    <anomaly type="suspicious" value="0.824518,0.981620,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="212.160.128.42" dst_ip="167.209.92.101" dst_port="80"/>
        </slice>
        <from usec="0" sec="1207285432"/>
        <to usec="0" sec="1207285620"/>
    </anomaly>
    <anomaly type="suspicious" value="0.824518,0.981620,503,1 1 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="167.209.145.21" dst_ip="106.145.150.15" dst_port="80"/>
            <filter src_ip="167.209.145.21" dst_ip="204.157.221.183" dst_port="80"/>
        </slice>
        <from usec="0" sec="1207285277"/>
        <to usec="0" sec="1207285544"/>
    </anomaly>
    <anomaly type="suspicious" value="0.824518,0.981620,503,1 1 0 0 0 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="206.75.194.229" dst_port="1133"/>
            <filter src_ip="206.96.240.45" dst_port="1133"/>
            <filter src_ip="206.96.240.45" dst_port="1044"/>
            <filter src_ip="206.75.194.229" dst_ip="167.209.34.162" src_port="80"/>
            <filter src_ip="206.96.240.202" dst_ip="167.209.34.162" src_port="80"/>
            <filter src_ip="206.96.240.45" dst_ip="167.209.34.162" src_port="80"/>
            <filter dst_ip="167.209.34.162" src_port="80" dst_port="1133"/>
            <filter dst_ip="167.209.34.162" src_port="80" dst_port="1044"/>
        </slice>
        <from usec="0" sec="1207285979"/>
        <to usec="0" sec="1207285982"/>
    </anomaly>
    <anomaly type="suspicious" value="0.824518,0.981620,999,1 1 0 0 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="167.209.168.208" src_port="25"/>
            <filter dst_ip="167.209.168.208" dst_port="25"/>
        </slice>
        <from usec="0" sec="1207285380"/>
        <to usec="0" sec="1207286091"/>
    </anomaly>
    <anomaly type="suspicious" value="0.824518,0.981620,503,1 1 0 0 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="160.86.89.210" dst_port="80"/>
        </slice>
        <from usec="0" sec="1207285211"/>
        <to usec="0" sec="1207285932"/>
    </anomaly>
    <anomaly type="suspicious" value="0.824518,0.981620,999,1 1 0 0 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="212.205.228.89" src_port="113"/>
            <filter dst_ip="212.205.228.89" dst_port="25"/>
        </slice>
        <from usec="0" sec="1207285302"/>
        <to usec="0" sec="1207285650"/>
    </anomaly>
    <anomaly type="suspicious" value="0.824518,0.981620,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="74.112.21.32" dst_ip="150.183.2.151" src_port="80" dst_port="1809"/>
            <filter src_ip="74.112.21.32" dst_ip="150.183.2.151" src_port="80" dst_port="1808"/>
        </slice>
        <from usec="0" sec="1207285678"/>
        <to usec="0" sec="1207285681"/>
    </anomaly>
    <anomaly type="suspicious" value="0.824518,0.981620,503,1 1 0 0 0 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="14.174.90.126" dst_ip="167.209.168.206" src_port="2489" dst_port="80"/>
            <filter src_ip="14.174.90.126" dst_ip="167.209.168.206" src_port="2488" dst_port="80"/>
            <filter src_ip="100.112.53.156" dst_ip="167.209.168.206" src_port="36846" dst_port="80"/>
            <filter src_ip="100.112.53.156" dst_ip="167.209.168.206" src_port="36693" dst_port="80"/>
        </slice>
        <from usec="0" sec="1207285697"/>
        <to usec="0" sec="1207285700"/>
    </anomaly>
    <anomaly type="suspicious" value="0.824518,0.981620,503,1 1 0 0 0 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="205.8.150.27" dst_ip="167.209.128.250" src_port="80" dst_port="2073"/>
            <filter src_ip="102.34.109.7" dst_ip="167.209.128.250" src_port="80" dst_port="2115"/>
            <filter src_ip="104.87.145.8" dst_ip="167.209.128.250" src_port="80" dst_port="2111"/>
            <filter src_ip="104.87.145.45" dst_ip="167.209.128.250" src_port="80" dst_port="2113"/>
            <filter src_ip="204.157.221.183" dst_ip="167.209.128.250" src_port="80" dst_port="2117"/>
        </slice>
        <from usec="0" sec="1207285731"/>
        <to usec="0" sec="1207285736"/>
    </anomaly>
    <anomaly type="suspicious" value="0.824518,0.981620,503,1 1 0 0 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="167.209.153.141" dst_port="80"/>
        </slice>
        <from usec="0" sec="1207285807"/>
        <to usec="0" sec="1207286013"/>
    </anomaly>
    <anomaly type="suspicious" value="0.796457,0.940121,503,1 1 0 1 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="220.222.234.172" dst_port="80"/>
        </slice>
        <from usec="0" sec="1207285259"/>
        <to usec="0" sec="1207285780"/>
    </anomaly>
    <anomaly type="suspicious" value="0.824518,0.981620,503,1 1 0 0 0 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter dst_ip="167.209.89.199" src_port="80"/>
            <filter src_ip="204.157.216.37" dst_ip="167.209.178.244" src_port="80"/>
        </slice>
        <from usec="0" sec="1207285202"/>
        <to usec="0" sec="1207286102"/>
    </anomaly>
    <anomaly type="suspicious" value="0.824518,0.981620,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="96.98.198.211" dst_ip="160.130.48.16" src_port="80"/>
        </slice>
        <from usec="0" sec="1207285928"/>
        <to usec="0" sec="1207286098"/>
    </anomaly>
    <anomaly type="suspicious" value="0.824518,0.981620,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="9.8.177.231" dst_ip="167.209.208.5" src_port="80"/>
        </slice>
        <from usec="0" sec="1207285318"/>
        <to usec="0" sec="1207285960"/>
    </anomaly>
    <anomaly type="suspicious" value="0.824518,0.981620,503,1 1 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="149.82.92.86" dst_port="80"/>
        </slice>
        <from usec="0" sec="1207285205"/>
        <to usec="0" sec="1207285453"/>
    </anomaly>
    <anomaly type="suspicious" value="0.824518,0.981620,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="185.129.69.23" dst_ip="212.160.143.207" dst_port="80"/>
        </slice>
        <from usec="0" sec="1207285220"/>
        <to usec="0" sec="1207285451"/>
    </anomaly>
    <anomaly type="suspicious" value="0.801640,0.995005,503,0 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="167.209.65.56" dst_ip="213.45.229.211" dst_port="80"/>
        </slice>
        <from usec="0" sec="1207285501"/>
        <to usec="0" sec="1207285504"/>
    </anomaly>
    <anomaly type="suspicious" value="0.824518,0.981620,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="167.209.178.137" dst_ip="212.82.102.80" dst_port="80"/>
        </slice>
        <from usec="0" sec="1207285322"/>
        <to usec="0" sec="1207285383"/>
    </anomaly>
    <anomaly type="suspicious" value="0.824518,0.981620,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="8.153.0.212" dst_port="445"/>
        </slice>
        <from usec="0" sec="1207285210"/>
        <to usec="0" sec="1207285213"/>
    </anomaly>
    <anomaly type="suspicious" value="0.824518,0.981620,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="68.98.93.157" dst_port="139"/>
        </slice>
        <from usec="0" sec="1207285992"/>
        <to usec="0" sec="1207286016"/>
    </anomaly>
    <anomaly type="suspicious" value="0.824518,0.981620,503,1 1 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="167.209.126.127" dst_port="80"/>
        </slice>
        <from usec="0" sec="1207285305"/>
        <to usec="0" sec="1207286050"/>
    </anomaly>
    <anomaly type="suspicious" value="0.824518,0.981620,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDPUDPICrp">
        <slice>
            <filter dst_ip="160.86.82.105"/>
        </slice>
        <from usec="0" sec="1207285779"/>
        <to usec="0" sec="1207285781"/>
    </anomaly>
    <anomaly type="suspicious" value="0.824518,0.981620,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="212.205.238.81" dst_ip="193.79.195.157" src_port="80"/>
        </slice>
        <from usec="0" sec="1207285279"/>
        <to usec="0" sec="1207285732"/>
    </anomaly>
    <anomaly type="suspicious" value="0.796457,0.940121,503,1 1 0 1 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="160.86.3.73" dst_port="80"/>
            <filter src_ip="167.209.20.232" dst_ip="201.39.126.63" src_port="80"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207286075"/>
    </anomaly>
    <anomaly type="suspicious" value="0.796457,0.940121,503,1 1 0 1 0 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="167.209.92.101" src_port="80"/>
            <filter dst_ip="77.49.67.33" src_port="80"/>
        </slice>
        <from usec="0" sec="1207285208"/>
        <to usec="0" sec="1207286028"/>
    </anomaly>
    <anomaly type="suspicious" value="0.796457,0.940121,503,1 1 0 1 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="149.82.94.131" dst_ip="204.213.84.172" dst_port="80"/>
            <filter src_ip="149.82.94.131" dst_ip="100.214.48.132" dst_port="80"/>
        </slice>
        <from usec="0" sec="1207285265"/>
        <to usec="0" sec="1207286070"/>
    </anomaly>
    <anomaly type="suspicious" value="0.840275,0.962560,503,0 0 0 1 1 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="167.209.20.167" dst_ip="101.134.72.138" dst_port="80"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207285398"/>
    </anomaly>
    <anomaly type="suspicious" value="0.862129,0.948718,503,1 0 0 1 1 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="204.157.250.191" src_port="80"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207286099"/>
    </anomaly>
    <anomaly type="suspicious" value="0.840275,0.962560,503,0 0 0 1 1 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="209.21.30.8" src_port="80"/>
            <filter dst_ip="160.86.52.164" src_port="80"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207285725"/>
    </anomaly>
    <anomaly type="suspicious" value="0.862129,0.948718,503,1 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="75.197.148.248" dst_ip="212.205.238.12" src_port="1858" dst_port="80"/>
        </slice>
        <from usec="0" sec="1207285474"/>
        <to usec="0" sec="1207285486"/>
    </anomaly>
    <anomaly type="suspicious" value="0.772748,0.954088,999,0 1 0 1 0 0 0 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="160.86.89.175" dst_port="53"/>
            <filter dst_ip="160.86.89.175" src_port="53" dst_port="51480"/>
        </slice>
        <from usec="0" sec="1207285363"/>
        <to usec="0" sec="1207285473"/>
    </anomaly>
    <anomaly type="suspicious" value="0.817082,0.902969,999,1 0 0 1 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="144.106.71.96" dst_port="53"/>
            <filter dst_ip="144.106.71.96" src_port="53" dst_port="53758"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207286020"/>
    </anomaly>
    <anomaly type="suspicious" value="0.796457,0.940121,503,1 1 0 1 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="167.209.74.1" dst_port="80"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207285844"/>
    </anomaly>
    <anomaly type="suspicious" value="0.862129,0.948718,503,1 0 0 1 1 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="167.209.217.113" dst_port="80"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207285848"/>
    </anomaly>
    <anomaly type="suspicious" value="0.840275,0.962560,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="102.72.182.42" dst_ip="167.209.180.123" src_port="80"/>
        </slice>
        <from usec="0" sec="1207285203"/>
        <to usec="0" sec="1207285839"/>
    </anomaly>
    <anomaly type="suspicious" value="0.862129,0.948718,999,1 0 0 1 1 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="160.86.194.33" src_port="53"/>
            <filter dst_ip="160.86.194.33" src_port="2703"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207286054"/>
    </anomaly>
    <anomaly type="suspicious" value="0.862129,0.948718,503,1 0 0 1 1 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="167.209.77.108" dst_port="80"/>
        </slice>
        <from usec="0" sec="1207285212"/>
        <to usec="0" sec="1207286019"/>
    </anomaly>
    <anomaly type="suspicious" value="0.862129,0.948718,999,1 0 0 1 1 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="212.205.227.45" dst_ip="213.65.229.134"/>
            <filter dst_ip="213.65.229.134" src_port="21"/>
            <filter src_ip="212.205.227.45" dst_ip="197.217.12.83" src_port="21"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207286028"/>
    </anomaly>
    <anomaly type="suspicious" value="0.840275,0.962560,503,0 0 0 1 1 0 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="204.157.242.85" dst_ip="167.209.217.113" src_port="80"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207286028"/>
    </anomaly>
    <anomaly type="suspicious" value="0.840275,0.962560,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="213.12.151.233" dst_ip="167.209.191.76" src_port="80"/>
        </slice>
        <from usec="0" sec="1207285262"/>
        <to usec="0" sec="1207285297"/>
    </anomaly>
    <anomaly type="suspicious" value="0.840275,0.962560,002,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="212.205.227.17" dst_ip="193.79.16.234" src_port="139"/>
            <filter src_ip="212.205.227.17" dst_ip="193.79.16.234" src_port="445"/>
        </slice>
        <from usec="0" sec="1207285295"/>
        <to usec="0" sec="1207285361"/>
    </anomaly>
    <anomaly type="suspicious" value="0.840275,0.962560,010,0 0 0 1 1 0 0 0 0 0 0 0,heavy_hitter">
        <slice>
            <filter src_ip="167.209.132.66" dst_ip="201.39.126.63" src_port="80"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207285488"/>
    </anomaly>
    <anomaly type="suspicious" value="0.840275,0.962560,999,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="119.233.84.248" dst_ip="167.209.149.223" src_port="4153" dst_port="60244"/>
            <filter src_ip="119.233.84.248" dst_ip="167.209.149.223" src_port="4153" dst_port="4827"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207285578"/>
    </anomaly>
    <anomaly type="suspicious" value="0.840275,0.962560,999,0 0 0 1 1 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="167.209.176.138" src_port="25"/>
            <filter src_ip="167.209.176.138" dst_port="25"/>
        </slice>
        <from usec="0" sec="1207285203"/>
        <to usec="0" sec="1207285557"/>
    </anomaly>
    <anomaly type="suspicious" value="0.840275,0.962560,010,0 0 0 1 1 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.183.92.194" dst_port="4662"/>
        </slice>
        <from usec="0" sec="1207285222"/>
        <to usec="0" sec="1207285578"/>
    </anomaly>
    <anomaly type="suspicious" value="0.840275,0.962560,503,0 0 0 1 1 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="103.128.62.129" dst_ip="144.106.12.128" dst_port="80"/>
            <filter src_ip="116.118.253.193" dst_ip="144.106.12.128" dst_port="80"/>
            <filter src_ip="100.112.34.32" dst_ip="144.106.12.128" dst_port="80"/>
            <filter src_ip="101.207.73.49" dst_ip="144.106.12.128" dst_port="80"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207285617"/>
    </anomaly>
    <anomaly type="suspicious" value="0.840275,0.962560,999,0 0 0 1 1 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="198.21.164.178" src_port="5050"/>
        </slice>
        <from usec="0" sec="1207285203"/>
        <to usec="0" sec="1207285938"/>
    </anomaly>
    <anomaly type="suspicious" value="0.840275,0.962560,999,0 0 0 1 1 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="149.82.1.89" dst_ip="194.59.67.32" src_port="55273" dst_port="63262"/>
            <filter src_ip="149.82.1.89" dst_ip="194.59.67.32" src_port="55273" dst_port="62373"/>
        </slice>
        <from usec="0" sec="1207285206"/>
        <to usec="0" sec="1207285668"/>
    </anomaly>
    <anomaly type="suspicious" value="0.840275,0.962560,503,0 0 0 1 1 0 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="160.86.118.129" dst_ip="209.67.198.15" dst_port="80"/>
        </slice>
        <from usec="0" sec="1207285210"/>
        <to usec="0" sec="1207285662"/>
    </anomaly>
    <anomaly type="suspicious" value="0.840275,0.962560,504,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="118.170.44.180" dst_ip="160.188.216.194" src_port="443" dst_port="1363"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207285758"/>
    </anomaly>
    <anomaly type="suspicious" value="0.840275,0.962560,503,0 0 0 1 1 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="144.106.82.129" dst_ip="101.207.77.26" src_port="80"/>
            <filter src_ip="185.129.30.149" dst_ip="101.207.77.26" src_port="80"/>
        </slice>
        <from usec="0" sec="1207285214"/>
        <to usec="0" sec="1207285752"/>
    </anomaly>
    <anomaly type="suspicious" value="0.840275,0.962560,999,0 0 0 1 1 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="100.96.234.46" dst_ip="144.106.206.145" dst_port="53"/>
            <filter src_ip="100.98.158.121" dst_ip="144.106.206.145" dst_port="53"/>
        </slice>
        <from usec="0" sec="1207285262"/>
        <to usec="0" sec="1207285756"/>
    </anomaly>
    <anomaly type="suspicious" value="0.840275,0.962560,010,0 0 0 1 1 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="160.188.218.80" src_port="50857"/>
            <filter src_ip="160.188.218.80" dst_ip="22.166.207.35" dst_port="515"/>
        </slice>
        <from usec="0" sec="1207285201"/>
        <to usec="0" sec="1207285847"/>
    </anomaly>
    <anomaly type="suspicious" value="0.840275,0.962560,999,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="167.209.46.159" dst_ip="105.138.184.207" dst_port="7144"/>
        </slice>
        <from usec="0" sec="1207285521"/>
        <to usec="0" sec="1207285847"/>
    </anomaly>
    <anomaly type="suspicious" value="0.840275,0.962560,999,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="87.108.70.46" dst_ip="160.86.16.214" src_port="3812" dst_port="9124"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207285931"/>
    </anomaly>
    <anomaly type="suspicious" value="0.840275,0.962560,503,0 0 0 1 1 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="167.209.169.1" dst_ip="160.233.193.38" src_port="80" dst_port="60219"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207285938"/>
    </anomaly>
    <anomaly type="suspicious" value="0.840275,0.962560,999,0 0 0 1 1 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="207.71.215.40" dst_ip="167.209.219.97" src_port="7002" dst_port="1913"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207285938"/>
    </anomaly>
    <anomaly type="suspicious" value="0.840275,0.962560,999,0 0 0 1 1 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="198.21.164.156" src_port="5050"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207285938"/>
    </anomaly>
    <anomaly type="suspicious" value="0.840275,0.962560,503,0 0 0 1 1 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="103.149.37.39" dst_ip="167.209.172.56" src_port="80"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207285938"/>
    </anomaly>
    <anomaly type="suspicious" value="0.840275,0.962560,503,0 0 0 1 1 0 0 0 0 0 0 0,ntscACKt">
        <slice>
            <filter src_ip="149.82.137.54" src_port="22683"/>
            <filter src_ip="149.82.137.54" dst_ip="165.171.196.163" dst_port="80"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207285896"/>
    </anomaly>
    <anomaly type="suspicious" value="0.840275,0.962560,503,0 0 0 1 1 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="212.192.13.13" src_port="80"/>
            <filter dst_ip="167.209.46.215" src_port="80"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207285935"/>
    </anomaly>
    <anomaly type="suspicious" value="0.840275,0.962560,999,0 0 0 1 1 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="117.182.89.160" dst_ip="144.106.4.161" dst_port="25"/>
            <filter src_ip="111.79.19.225" dst_ip="144.106.4.161" dst_port="25"/>
        </slice>
        <from usec="0" sec="1207285201"/>
        <to usec="0" sec="1207285779"/>
    </anomaly>
    <anomaly type="suspicious" value="0.840275,0.962560,503,0 0 0 1 1 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="213.51.26.67" dst_ip="77.49.67.8" src_port="80"/>
            <filter src_ip="213.51.26.67" dst_ip="101.207.72.90" src_port="80"/>
            <filter src_ip="213.51.26.67" dst_ip="206.81.41.142" src_port="80"/>
        </slice>
        <from usec="0" sec="1207285215"/>
        <to usec="0" sec="1207285887"/>
    </anomaly>
    <anomaly type="suspicious" value="0.840275,0.962560,010,0 0 0 1 1 0 0 0 0 0 0 0,sptpDoSSYN">
        <slice>
            <filter src_ip="213.51.24.12" dst_ip="13.1.195.25" dst_port="80"/>
        </slice>
        <from usec="0" sec="1207285219"/>
        <to usec="0" sec="1207285932"/>
    </anomaly>
    <anomaly type="suspicious" value="0.840275,0.962560,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="149.82.92.96" dst_ip="14.20.77.47" dst_port="80"/>
        </slice>
        <from usec="0" sec="1207285633"/>
        <to usec="0" sec="1207285935"/>
    </anomaly>
    <anomaly type="suspicious" value="0.840275,0.962560,503,0 0 0 1 1 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="208.53.88.78" dst_ip="167.209.184.88" src_port="80" dst_port="3549"/>
            <filter src_ip="208.53.88.78" dst_ip="167.209.184.88" src_port="80" dst_port="3547"/>
            <filter src_ip="208.53.88.78" dst_ip="167.209.182.82" src_port="80" dst_port="3171"/>
            <filter src_ip="208.53.88.78" dst_ip="167.209.182.82" src_port="80" dst_port="3169"/>
        </slice>
        <from usec="0" sec="1207285833"/>
        <to usec="0" sec="1207285911"/>
    </anomaly>
    <anomaly type="suspicious" value="0.840275,0.962560,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="167.209.153.137" dst_ip="200.135.107.218" src_port="80" dst_port="49797"/>
            <filter src_ip="167.209.153.137" dst_ip="200.135.107.218" src_port="80" dst_port="49662"/>
        </slice>
        <from usec="0" sec="1207285865"/>
        <to usec="0" sec="1207285878"/>
    </anomaly>
    <anomaly type="suspicious" value="0.840275,0.962560,999,0 0 0 1 1 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="106.64.29.4" src_port="25"/>
            <filter dst_ip="167.209.168.210" src_port="25"/>
        </slice>
        <from usec="0" sec="1207285210"/>
        <to usec="0" sec="1207286012"/>
    </anomaly>
    <anomaly type="suspicious" value="0.840275,0.962560,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="213.60.29.252" dst_ip="167.209.159.46" src_port="80"/>
        </slice>
        <from usec="0" sec="1207285511"/>
        <to usec="0" sec="1207285978"/>
    </anomaly>
    <anomaly type="suspicious" value="0.840275,0.962560,503,0 0 0 1 1 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="167.209.184.53" dst_ip="77.44.137.35" src_port="80"/>
        </slice>
        <from usec="0" sec="1207285857"/>
        <to usec="0" sec="1207285986"/>
    </anomaly>
    <anomaly type="suspicious" value="0.822134,0.959979,020,0 0 0 0 0 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="196.68.191.68"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207285246"/>
    </anomaly>
    <anomaly type="suspicious" value="0.862129,0.948718,999,1 0 0 1 1 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter dst_ip="144.106.85.212" dst_port="25"/>
            <filter dst_ip="144.106.85.218" src_port="25"/>
            <filter dst_ip="144.106.85.218" dst_port="25"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207286028"/>
    </anomaly>
    <anomaly type="suspicious" value="0.822134,0.959979,004,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="192.25.96.12" src_port="445"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207285246"/>
    </anomaly>
    <anomaly type="suspicious" value="0.822134,0.959979,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="8.156.78.164" dst_port="445"/>
        </slice>
        <from usec="0" sec="1207285335"/>
        <to usec="0" sec="1207285381"/>
    </anomaly>
    <anomaly type="suspicious" value="0.844458,0.946100,999,1 0 0 0 0 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="167.209.128.32" dst_port="25"/>
        </slice>
        <from usec="0" sec="1207285256"/>
        <to usec="0" sec="1207285381"/>
    </anomaly>
    <anomaly type="suspicious" value="0.938141,0.985094,503,1 0 0 1 0 0 0 0 1 0 0 0,mptmp">
        <slice>
            <filter dst_ip="167.209.128.32" dst_port="25"/>
            <filter dst_ip="167.209.165.113" src_port="80"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207286043"/>
    </anomaly>
    <anomaly type="suspicious" value="0.793989,0.917501,999,0 0 0 1 0 0 1 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="205.10.218.105" dst_ip="144.106.77.8" dst_port="53"/>
            <filter src_ip="205.10.218.105" dst_ip="144.106.71.96" dst_port="53"/>
        </slice>
        <from usec="0" sec="1207285206"/>
        <to usec="0" sec="1207285696"/>
    </anomaly>
    <anomaly type="suspicious" value="0.864115,0.959583,999,0 0 0 1 0 0 0 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="213.61.121.54" src_port="11994"/>
            <filter src_ip="213.61.121.54" src_port="20129" dst_port="20129"/>
        </slice>
        <from usec="0" sec="1207285204"/>
        <to usec="0" sec="1207285757"/>
    </anomaly>
    <anomaly type="suspicious" value="0.793989,0.917501,020,0 0 0 1 0 0 1 0 0 0 0 0,ntscICecrqICecrqdurmterp">
        <slice>
            <filter dst_ip="212.205.238.94"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207285741"/>
    </anomaly>
    <anomaly type="suspicious" value="0.844458,0.946100,503,1 0 0 0 0 0 1 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="212.192.13.12" src_port="80"/>
        </slice>
        <from usec="0" sec="1207285335"/>
        <to usec="0" sec="1207286026"/>
    </anomaly>
    <anomaly type="suspicious" value="0.844458,0.946100,999,1 0 0 0 0 0 1 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="210.94.144.242" dst_ip="212.205.237.32" dst_port="3128"/>
            <filter src_ip="210.94.144.242" dst_ip="212.205.237.32" dst_port="3127"/>
            <filter src_ip="210.94.144.242" dst_ip="212.205.237.32" dst_port="3124"/>
        </slice>
        <from usec="0" sec="1207285335"/>
        <to usec="0" sec="1207286027"/>
    </anomaly>
    <anomaly type="suspicious" value="0.840275,0.962560,999,0 0 0 1 1 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="160.188.216.50" dst_port="53"/>
            <filter dst_ip="160.188.216.50" dst_port="25"/>
            <filter dst_ip="160.188.216.50" src_port="53" dst_port="65160"/>
        </slice>
        <from usec="0" sec="1207285200"/>
        <to usec="0" sec="1207286005"/>
    </anomaly>
    <anomaly type="suspicious" value="0.840275,0.962560,999,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="212.205.237.33" dst_ip="114.122.17.67" dst_port="25899"/>
        </slice>
        <from usec="0" sec="1207285221"/>
        <to usec="0" sec="1207285837"/>
    </anomaly>
    <anomaly type="suspicious" value="0.918098,0.998432,999,0 0 0 1 0 0 0 0 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="196.187.213.146" src_port="3040" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1207285335"/>
        <to usec="0" sec="1207285381"/>
    </anomaly>
    <anomaly type="suspicious" value="0.822134,0.959979,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="167.209.236.96" src_port="59173" dst_port="53"/>
        </slice>
        <from usec="0" sec="1207285335"/>
        <to usec="0" sec="1207285381"/>
    </anomaly>
    <anomaly type="suspicious" value="0.822134,0.959979,503,0 0 0 0 0 0 1 0 0 0 0 0,heavy_hitter">
        <slice>
            <filter src_ip="198.21.166.186" dst_ip="144.106.71.119" src_port="80"/>
        </slice>
        <from usec="0" sec="1207285335"/>
        <to usec="0" sec="1207285381"/>
    </anomaly>
</admd:annotation>
