<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="anomalous" value="1.162200,1.073170,999,0 1 0 1 0 0 1 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="199.104.131.3" dst_ip="19.70.1.233" src_port="3124"/>
            <filter src_ip="173.184.237.225" dst_ip="19.70.1.233" src_port="3127"/>
        </slice>
        <from usec="0" sec="1209963605"/>
        <to usec="0" sec="1209964282"/>
    </anomaly>
    <anomaly type="anomalous" value="1.131980,1.126970,999,0 1 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="223.94.28.198" src_port="50541" dst_port="1026"/>
        </slice>
        <from usec="0" sec="1209964175"/>
        <to usec="0" sec="1209964180"/>
    </anomaly>
    <anomaly type="anomalous" value="2.010150,1.739520,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="223.95.4.137" dst_port="1026"/>
            <filter src_ip="223.95.4.137" dst_port="1027"/>
        </slice>
        <from usec="0" sec="1209964426"/>
        <to usec="0" sec="1209964431"/>
    </anomaly>
    <anomaly type="anomalous" value="2.010150,1.739520,503,1 1 1 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="213.20.126.100" dst_ip="131.73.116.83" src_port="80"/>
        </slice>
        <from usec="0" sec="1209963660"/>
        <to usec="0" sec="1209963663"/>
    </anomaly>
    <anomaly type="anomalous" value="1.229280,1.050330,503,1 0 0 1 1 1 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="199.104.136.34" src_port="80"/>
            <filter src_ip="199.104.136.34" src_port="21"/>
        </slice>
        <from usec="0" sec="1209963600"/>
        <to usec="0" sec="1209964428"/>
    </anomaly>
    <anomaly type="anomalous" value="1.272130,1.064220,020,1 0 0 1 1 1 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="199.104.131.2"/>
        </slice>
        <from usec="0" sec="1209963600"/>
        <to usec="0" sec="1209964423"/>
    </anomaly>
    <anomaly type="anomalous" value="0.939635,0.868937,502,1 0 0 1 1 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="221.149.104.34" dst_port="22"/>
        </slice>
        <from usec="0" sec="1209963600"/>
        <to usec="0" sec="1209964486"/>
    </anomaly>
    <anomaly type="anomalous" value="1.242110,1.067250,020,1 1 0 1 0 0 1 0 0 0 0 0,icmp_error">
        <slice>
            <filter dst_ip="173.184.237.234"/>
        </slice>
        <from usec="0" sec="1209963604"/>
        <to usec="0" sec="1209964411"/>
    </anomaly>
    <anomaly type="anomalous" value="1.148480,1.056340,503,0 0 0 1 1 1 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="131.81.208.50" dst_ip="26.233.8.236" src_port="80" dst_port="51912"/>
            <filter src_ip="131.81.208.50" dst_ip="16.44.224.86" src_port="80" dst_port="41672"/>
            <filter src_ip="131.73.237.227" dst_ip="26.233.8.236" src_port="80" dst_port="62753"/>
        </slice>
        <from usec="0" sec="1209963617"/>
        <to usec="0" sec="1209963777"/>
    </anomaly>
    <anomaly type="anomalous" value="1.957920,1.613190,999,1 0 0 1 1 1 1 1 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="199.104.131.2"/>
        </slice>
        <from usec="0" sec="1209963600"/>
        <to usec="0" sec="1209964489"/>
    </anomaly>
    <anomaly type="anomalous" value="1.148480,1.056340,501,0 0 0 1 1 1 0 0 0 0 0 0,heavy_hitter">
        <slice>
            <filter src_ip="199.104.140.180" dst_ip="178.151.2.200" src_port="21"/>
        </slice>
        <from usec="0" sec="1209963600"/>
        <to usec="0" sec="1209964068"/>
    </anomaly>
    <anomaly type="anomalous" value="1.148480,1.056340,503,0 0 0 1 1 1 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="67.58.70.0" dst_ip="131.84.228.58" src_port="80" dst_port="59062"/>
            <filter src_ip="67.58.70.51" dst_ip="131.84.228.58" src_port="80" dst_port="58839"/>
            <filter src_ip="67.58.70.33" dst_ip="131.84.228.58" src_port="80" dst_port="59063"/>
        </slice>
        <from usec="0" sec="1209963811"/>
        <to usec="0" sec="1209963939"/>
    </anomaly>
    <anomaly type="anomalous" value="1.148480,1.056340,503,0 0 0 1 1 1 0 0 0 0 0 0,mptmp">
        <slice>
            <filter dst_ip="132.168.244.238" src_port="80"/>
            <filter dst_ip="132.168.244.233" src_port="80"/>
        </slice>
        <from usec="0" sec="1209963600"/>
        <to usec="0" sec="1209964427"/>
    </anomaly>
    <anomaly type="anomalous" value="1.229280,1.050330,503,1 0 0 1 1 1 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="67.195.25.236" dst_ip="131.84.228.61" src_port="80"/>
            <filter src_ip="36.36.36.22" dst_ip="131.84.228.61" src_port="80"/>
        </slice>
        <from usec="0" sec="1209963600"/>
        <to usec="0" sec="1209964158"/>
    </anomaly>
    <anomaly type="anomalous" value="1.709250,1.552210,999,1 0 1 1 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="223.94.28.198" src_port="50541"/>
            <filter src_ip="223.94.28.198" dst_port="1026"/>
            <filter src_ip="223.94.28.198" dst_port="1027"/>
            <filter src_port="50541" dst_port="1026"/>
            <filter src_port="50541" dst_port="1027"/>
        </slice>
        <from usec="0" sec="1209964175"/>
        <to usec="0" sec="1209964180"/>
    </anomaly>
    <anomaly type="anomalous" value="2.044350,1.641250,999,1 1 0 1 1 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="199.104.131.3" dst_port="3124"/>
            <filter dst_ip="199.104.131.3" dst_port="3128"/>
        </slice>
        <from usec="0" sec="1209963600"/>
        <to usec="0" sec="1209964501"/>
    </anomaly>
    <anomaly type="anomalous" value="2.044350,1.641250,999,1 1 0 1 1 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="203.55.112.235" src_port="53"/>
        </slice>
        <from usec="0" sec="1209963600"/>
        <to usec="0" sec="1209964501"/>
    </anomaly>
    <anomaly type="anomalous" value="1.148480,1.056340,503,0 0 0 1 1 1 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="218.179.198.30" dst_ip="131.73.71.104" src_port="80"/>
        </slice>
        <from usec="0" sec="1209963627"/>
        <to usec="0" sec="1209964332"/>
    </anomaly>
    <anomaly type="anomalous" value="1.198190,1.053400,503,1 1 0 1 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="131.73.70.196" dst_port="80"/>
        </slice>
        <from usec="0" sec="1209963600"/>
        <to usec="0" sec="1209964428"/>
    </anomaly>
    <anomaly type="anomalous" value="1.272130,1.064220,999,1 0 0 1 1 1 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="173.184.237.234"/>
            <filter src_ip="173.184.237.234" src_port="59929" dst_port="1340"/>
        </slice>
        <from usec="0" sec="1209963600"/>
        <to usec="0" sec="1209964489"/>
    </anomaly>
    <anomaly type="anomalous" value="2.271490,1.827720,010,1 1 1 1 1 1 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="221.77.163.34" src_port="6000" dst_port="3306"/>
        </slice>
        <from usec="0" sec="1209964208"/>
        <to usec="0" sec="1209964351"/>
    </anomaly>
    <anomaly type="anomalous" value="1.148480,1.056340,503,0 0 0 1 1 1 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="157.238.40.70" dst_ip="26.233.1.215" src_port="80"/>
            <filter src_ip="157.238.40.70" dst_ip="26.233.1.215" src_port="21"/>
        </slice>
        <from usec="0" sec="1209963600"/>
        <to usec="0" sec="1209964428"/>
    </anomaly>
    <anomaly type="anomalous" value="1.148480,1.056340,503,0 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="131.81.237.231" dst_ip="26.233.10.35" src_port="80" dst_port="65143"/>
            <filter src_ip="131.81.237.231" dst_ip="26.233.10.35" src_port="80" dst_port="36483"/>
            <filter src_ip="131.81.237.231" dst_ip="26.233.10.35" src_port="80" dst_port="35865"/>
            <filter src_ip="131.81.237.231" dst_ip="26.233.10.35" src_port="80" dst_port="35061"/>
        </slice>
        <from usec="0" sec="1209963601"/>
        <to usec="0" sec="1209963672"/>
    </anomaly>
    <anomaly type="anomalous" value="1.401520,1.106300,503,1 1 0 1 1 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="199.104.136.34" dst_port="80"/>
            <filter dst_ip="199.104.136.34" dst_port="21"/>
        </slice>
        <from usec="0" sec="1209963600"/>
        <to usec="0" sec="1209964498"/>
    </anomaly>
    <anomaly type="anomalous" value="2.294960,1.835740,010,1 1 1 1 1 1 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="219.71.194.26" src_port="6000" dst_port="2967"/>
        </slice>
        <from usec="0" sec="1209963864"/>
        <to usec="0" sec="1209964006"/>
    </anomaly>
    <anomaly type="anomalous" value="1.148480,1.056340,503,0 0 0 1 1 1 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="193.170.212.172" dst_ip="173.184.39.162" src_port="80"/>
            <filter src_ip="26.161.67.112" dst_ip="173.184.39.162" src_port="80"/>
        </slice>
        <from usec="0" sec="1209963928"/>
        <to usec="0" sec="1209964208"/>
    </anomaly>
    <anomaly type="anomalous" value="1.148480,1.056340,503,0 0 0 1 1 1 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="131.73.70.197" dst_ip="215.101.73.91" src_port="80"/>
        </slice>
        <from usec="0" sec="1209964313"/>
        <to usec="0" sec="1209964425"/>
    </anomaly>
    <anomaly type="anomalous" value="1.148480,1.056340,503,0 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="131.81.208.41" dst_ip="26.233.1.179" src_port="80"/>
        </slice>
        <from usec="0" sec="1209963600"/>
        <to usec="0" sec="1209964068"/>
    </anomaly>
    <anomaly type="anomalous" value="1.148480,1.056340,020,0 0 0 1 1 1 0 0 0 0 0 0,icmp_error">
        <slice>
            <filter dst_ip="197.47.80.7"/>
        </slice>
        <from usec="0" sec="1209963809"/>
        <to usec="0" sec="1209964158"/>
    </anomaly>
    <anomaly type="anomalous" value="0.939635,0.868937,503,1 0 0 1 1 0 1 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="198.56.241.137" dst_ip="216.22.70.16" dst_port="80"/>
        </slice>
        <from usec="0" sec="1209963600"/>
        <to usec="0" sec="1209964483"/>
    </anomaly>
    <anomaly type="anomalous" value="1.938550,1.615190,999,1 1 0 1 0 0 1 1 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="199.104.131.10" src_port="3128"/>
            <filter src_ip="199.104.131.3" src_port="3124"/>
        </slice>
        <from usec="0" sec="1209963601"/>
        <to usec="0" sec="1209964501"/>
    </anomaly>
    <anomaly type="anomalous" value="2.735320,2.199940,999,1 1 1 1 1 1 1 1 0 0 0 0,mptmp">
        <slice>
            <filter dst_ip="19.70.1.233"/>
            <filter src_ip="199.104.131.11" src_port="3128"/>
            <filter src_ip="199.104.131.11" src_port="3124"/>
        </slice>
        <from usec="0" sec="1209963600"/>
        <to usec="0" sec="1209964488"/>
    </anomaly>
    <anomaly type="anomalous" value="2.044350,1.641250,999,1 1 0 1 1 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.55.112.235" dst_port="53"/>
        </slice>
        <from usec="0" sec="1209963600"/>
        <to usec="0" sec="1209964501"/>
    </anomaly>
    <anomaly type="anomalous" value="1.541860,1.457150,020,0 0 0 1 0 0 0 1 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="199.104.128.156"/>
        </slice>
        <from usec="0" sec="1209963677"/>
        <to usec="0" sec="1209964273"/>
    </anomaly>
    <anomaly type="suspicious" value="0.626229,0.888012,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="132.168.84.238" dst_ip="212.12.137.114" src_port="3537" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1209963909"/>
        <to usec="0" sec="1209963913"/>
    </anomaly>
    <anomaly type="suspicious" value="0.626229,0.888012,503,1 0 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="132.168.64.66"/>
        </slice>
        <from usec="0" sec="1209963785"/>
        <to usec="0" sec="1209963788"/>
    </anomaly>
    <anomaly type="suspicious" value="0.626229,0.888012,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="212.12.134.17"/>
        </slice>
        <from usec="0" sec="1209964174"/>
        <to usec="0" sec="1209964178"/>
    </anomaly>
    <anomaly type="suspicious" value="0.626229,0.888012,002,1 0 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="7.92.46.55"/>
        </slice>
        <from usec="0" sec="1209964334"/>
        <to usec="0" sec="1209964348"/>
    </anomaly>
    <anomaly type="suspicious" value="0.626229,0.888012,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="173.184.39.102" dst_ip="199.137.140.139" src_port="1202" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1209963943"/>
        <to usec="0" sec="1209964409"/>
    </anomaly>
    <anomaly type="suspicious" value="0.626229,0.888012,503,1 0 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="131.73.116.83"/>
        </slice>
        <from usec="0" sec="1209963694"/>
        <to usec="0" sec="1209963697"/>
    </anomaly>
    <anomaly type="suspicious" value="0.626229,0.888012,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="198.166.194.130" dst_ip="199.104.128.244" src_port="4352" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1209964310"/>
        <to usec="0" sec="1209964313"/>
    </anomaly>
    <anomaly type="suspicious" value="0.626229,0.888012,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="199.137.140.139"/>
        </slice>
        <from usec="0" sec="1209964074"/>
        <to usec="0" sec="1209964077"/>
    </anomaly>
    <anomaly type="suspicious" value="0.626229,0.888012,503,1 0 0 0 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="173.184.237.142"/>
        </slice>
        <from usec="0" sec="1209964324"/>
        <to usec="0" sec="1209964328"/>
    </anomaly>
    <anomaly type="suspicious" value="0.626229,0.888012,503,1 0 0 0 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="131.73.211.122"/>
        </slice>
        <from usec="0" sec="1209964395"/>
        <to usec="0" sec="1209964398"/>
    </anomaly>
    <anomaly type="suspicious" value="0.626229,0.888012,503,1 0 0 0 0 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="132.168.226.110" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1209963782"/>
        <to usec="0" sec="1209964037"/>
    </anomaly>
    <anomaly type="suspicious" value="0.626229,0.888012,503,1 0 0 0 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="199.104.132.125" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1209963782"/>
        <to usec="0" sec="1209964129"/>
    </anomaly>
    <anomaly type="suspicious" value="0.626229,0.888012,999,1 0 0 0 0 0 0 0 0 0 0 0,heavy_hitter">
        <slice>
            <filter src_ip="173.184.237.225" dst_ip="19.70.1.233" src_port="3127"/>
        </slice>
        <from usec="0" sec="1209964244"/>
        <to usec="0" sec="1209964285"/>
    </anomaly>
    <anomaly type="suspicious" value="0.626229,0.888012,002,1 0 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="67.112.58.135" src_port="1029" dst_port="137" proto="udp"/>
        </slice>
        <from usec="0" sec="1209964475"/>
        <to usec="0" sec="1209964488"/>
    </anomaly>
    <anomaly type="suspicious" value="0.626229,0.888012,002,1 0 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="54.248.99.137" src_port="1027" dst_port="137" proto="udp"/>
        </slice>
        <from usec="0" sec="1209963694"/>
        <to usec="0" sec="1209963708"/>
    </anomaly>
    <anomaly type="suspicious" value="0.626229,0.888012,999,1 0 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="223.94.28.249" src_port="57732" dst_port="1026"/>
            <filter src_ip="223.94.28.249" src_port="57732" dst_port="1027"/>
        </slice>
        <from usec="0" sec="1209963634"/>
        <to usec="0" sec="1209963637"/>
    </anomaly>
    <anomaly type="suspicious" value="0.626229,0.888012,002,1 0 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="67.207.36.255" src_port="1026" dst_port="137" proto="udp"/>
        </slice>
        <from usec="0" sec="1209963716"/>
        <to usec="0" sec="1209963718"/>
    </anomaly>
    <anomaly type="suspicious" value="0.626229,0.888012,002,1 0 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="34.168.0.162" src_port="1025" dst_port="137" proto="udp"/>
        </slice>
        <from usec="0" sec="1209963923"/>
        <to usec="0" sec="1209963926"/>
    </anomaly>
    <anomaly type="suspicious" value="0.626229,0.888012,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="18.165.33.212" dst_port="135"/>
        </slice>
        <from usec="0" sec="1209963750"/>
        <to usec="0" sec="1209964499"/>
    </anomaly>
    <anomaly type="suspicious" value="0.626229,0.888012,001,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNtSAbado">
        <slice>
            <filter src_ip="36.57.185.1" dst_port="9898" proto="tcp"/>
        </slice>
        <from usec="0" sec="1209964347"/>
        <to usec="0" sec="1209964349"/>
    </anomaly>
    <anomaly type="suspicious" value="0.626229,0.888012,002,1 0 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="221.119.250.194" dst_port="137" proto="udp"/>
        </slice>
        <from usec="0" sec="1209963887"/>
        <to usec="0" sec="1209963891"/>
    </anomaly>
    <anomaly type="suspicious" value="0.626229,0.888012,002,1 0 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="2.153.130.232" dst_port="137" proto="udp"/>
        </slice>
        <from usec="0" sec="1209963779"/>
        <to usec="0" sec="1209963792"/>
    </anomaly>
    <anomaly type="suspicious" value="0.626229,0.888012,503,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="68.24.2.107"/>
        </slice>
        <from usec="0" sec="1209963739"/>
        <to usec="0" sec="1209963744"/>
    </anomaly>
    <anomaly type="suspicious" value="0.626229,0.888012,503,1 0 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="133.26.113.172"/>
        </slice>
        <from usec="0" sec="1209964465"/>
        <to usec="0" sec="1209964469"/>
    </anomaly>
    <anomaly type="suspicious" value="0.595253,0.800506,503,1 0 0 1 0 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="19.12.32.31" dst_ip="131.73.138.187" dst_port="80"/>
            <filter src_ip="199.24.66.8" dst_ip="131.73.138.187" dst_port="80"/>
        </slice>
        <from usec="0" sec="1209963600"/>
        <to usec="0" sec="1209964472"/>
    </anomaly>
    <anomaly type="suspicious" value="0.831140,0.876195,999,0 0 0 1 1 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="131.73.70.133" src_port="53"/>
            <filter src_ip="131.73.70.133" dst_port="53"/>
            <filter src_ip="131.73.161.147" dst_port="53"/>
        </slice>
        <from usec="0" sec="1209963600"/>
        <to usec="0" sec="1209964333"/>
    </anomaly>
    <anomaly type="suspicious" value="0.595253,0.800506,503,1 0 0 1 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="132.168.244.238" dst_port="80"/>
        </slice>
        <from usec="0" sec="1209963600"/>
        <to usec="0" sec="1209964376"/>
    </anomaly>
    <anomaly type="suspicious" value="0.763949,0.859263,020,0 0 0 1 1 0 0 0 0 0 0 0,ttl_error">
        <slice>
            <filter src_ip="131.168.66.13"/>
        </slice>
        <from usec="0" sec="1209963600"/>
        <to usec="0" sec="1209964428"/>
    </anomaly>
    <anomaly type="suspicious" value="0.595253,0.800506,503,1 0 0 1 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="173.184.237.142" src_port="80"/>
        </slice>
        <from usec="0" sec="1209963600"/>
        <to usec="0" sec="1209964410"/>
    </anomaly>
    <anomaly type="suspicious" value="0.831140,0.876195,999,0 0 0 1 1 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="132.168.52.35" src_port="53"/>
            <filter dst_ip="132.168.52.35" dst_port="53"/>
            <filter dst_ip="169.240.170.155" dst_port="53"/>
        </slice>
        <from usec="0" sec="1209963600"/>
        <to usec="0" sec="1209964411"/>
    </anomaly>
    <anomaly type="suspicious" value="0.595253,0.800506,503,1 0 0 1 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="132.168.229.132" dst_ip="204.42.61.224" dst_port="80"/>
        </slice>
        <from usec="0" sec="1209963634"/>
        <to usec="0" sec="1209964482"/>
    </anomaly>
    <anomaly type="suspicious" value="0.679340,0.818655,999,1 0 0 1 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="131.73.100.104" dst_port="65013"/>
        </slice>
        <from usec="0" sec="1209963603"/>
        <to usec="0" sec="1209964411"/>
    </anomaly>
    <anomaly type="suspicious" value="0.788323,0.941322,999,0 0 0 0 1 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="219.158.213.210" dst_ip="199.104.140.180" src_port="60700" dst_port="18648"/>
            <filter src_ip="219.158.213.210" dst_ip="199.104.140.180" src_port="60699" dst_port="21"/>
        </slice>
        <from usec="0" sec="1209963755"/>
        <to usec="0" sec="1209964428"/>
    </anomaly>
    <anomaly type="suspicious" value="0.788323,0.941322,503,0 0 0 0 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="213.20.121.180" dst_ip="173.184.38.226" src_port="80"/>
        </slice>
        <from usec="0" sec="1209963608"/>
        <to usec="0" sec="1209964297"/>
    </anomaly>
    <anomaly type="suspicious" value="0.763949,0.859263,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="173.184.237.143" dst_ip="131.203.209.161" src_port="80" dst_port="60067"/>
            <filter src_ip="173.184.237.143" dst_ip="131.203.209.161" src_port="80" dst_port="60065"/>
            <filter src_ip="173.184.237.143" dst_ip="131.203.209.161" src_port="80" dst_port="60064"/>
            <filter src_ip="173.184.237.143" dst_ip="131.203.209.161" src_port="80" dst_port="60035"/>
        </slice>
        <from usec="0" sec="1209963982"/>
        <to usec="0" sec="1209964336"/>
    </anomaly>
    <anomaly type="suspicious" value="0.763949,0.859263,020,0 0 0 1 1 0 0 0 0 0 0 0,icmp_error">
        <slice>
            <filter src_ip="151.27.104.140"/>
        </slice>
        <from usec="0" sec="1209963993"/>
        <to usec="0" sec="1209964416"/>
    </anomaly>
    <anomaly type="suspicious" value="0.947415,1.015380,503,0 0 0 1 0 1 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="213.20.121.180" dst_ip="173.184.38.226" src_port="80"/>
        </slice>
        <from usec="0" sec="1209963608"/>
        <to usec="0" sec="1209964297"/>
    </anomaly>
    <anomaly type="suspicious" value="0.706639,0.904406,999,1 0 0 0 0 0 1 0 0 0 0 0,heavy_hitter">
        <slice>
            <filter src_ip="19.70.1.233" dst_ip="173.184.237.225" dst_port="3127"/>
        </slice>
        <from usec="0" sec="1209963790"/>
        <to usec="0" sec="1209964411"/>
    </anomaly>
    <anomaly type="suspicious" value="0.831140,0.876195,503,0 0 0 1 1 0 1 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="21.22.165.24" dst_ip="169.240.171.37" src_port="80"/>
            <filter src_ip="21.22.165.24" dst_ip="169.240.171.36" src_port="80"/>
        </slice>
        <from usec="0" sec="1209963600"/>
        <to usec="0" sec="1209964411"/>
    </anomaly>
    <anomaly type="suspicious" value="0.706639,0.904406,501,1 0 0 0 0 0 1 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="178.151.2.200" dst_ip="199.104.140.180" dst_port="21"/>
            <filter src_ip="223.86.136.106" dst_ip="199.104.140.180" dst_port="21"/>
        </slice>
        <from usec="0" sec="1209964365"/>
        <to usec="0" sec="1209964438"/>
    </anomaly>
    <anomaly type="suspicious" value="0.706639,0.904406,999,1 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="131.73.161.147" src_port="53"/>
            <filter dst_ip="131.73.161.147" src_port="2703"/>
        </slice>
        <from usec="0" sec="1209963808"/>
        <to usec="0" sec="1209964411"/>
    </anomaly>
    <anomaly type="suspicious" value="0.679340,0.818655,999,1 0 0 1 0 0 1 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="173.184.237.232" src_port="3128"/>
            <filter src_ip="199.104.131.10" dst_ip="212.70.144.100" src_port="3128"/>
        </slice>
        <from usec="0" sec="1209963600"/>
        <to usec="0" sec="1209964411"/>
    </anomaly>
    <anomaly type="suspicious" value="0.706639,0.904406,999,1 0 0 0 0 0 1 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="200.168.171.126" dst_ip="203.55.112.237" dst_port="53"/>
        </slice>
        <from usec="0" sec="1209963779"/>
        <to usec="0" sec="1209964501"/>
    </anomaly>
</admd:annotation>
