<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="anomalous" value="1.470480,1.449480,999,1 1 0 1 0 0 1 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="217.26.9.181" dst_ip="175.58.207.33"/>
            <filter src_ip="217.26.9.181" dst_port="3128"/>
            <filter dst_ip="175.58.207.33" dst_port="3128"/>
            <filter dst_ip="175.58.207.33" dst_port="3124"/>
            <filter src_ip="42.108.32.48" dst_ip="175.58.207.33" dst_port="3127"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.597990,1.433930,503,1 0 0 1 1 0 1 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="192.161.35.97" dst_port="53"/>
            <filter src_ip="192.161.35.97" dst_port="80"/>
            <filter src_ip="145.164.118.0" dst_port="53"/>
            <filter src_ip="145.164.118.2" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.707070,2.220210,503,1 1 1 1 1 1 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="193.109.119.29" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.905430,1.821570,503,1 1 1 1 0 0 0 0 0 1 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="192.161.26.102" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.046420,1.729320,503,1 1 0 1 1 1 0 0 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="193.109.119.29" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.819540,1.599530,503,1 1 0 0 0 0 0 0 0 1 1 1,mptplaHTTP">
        <slice>
            <filter dst_ip="145.164.250.251" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.914660,1.610100,999,1 1 0 1 1 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter src_ip="171.57.73.61" dst_ip="193.109.123.138"/>
            <filter src_ip="208.32.64.30" dst_ip="193.109.123.138"/>
            <filter src_ip="208.32.64.30" dst_port="21"/>
            <filter dst_ip="193.109.123.138" dst_port="80"/>
            <filter dst_ip="193.109.123.138" dst_port="21"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.852810,1.841930,999,1 1 1 0 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="193.109.98.220" dst_ip="192.160.196.202" src_port="58860" dst_port="25"/>
            <filter src_ip="150.239.17.182" dst_ip="192.160.196.202" src_port="41187" dst_port="25"/>
        </slice>
        <from usec="0" sec="1218172467"/>
        <to usec="0" sec="1218172471"/>
    </anomaly>
    <anomaly type="anomalous" value="1.852810,1.841930,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="192.204.1.220" dst_port="135"/>
        </slice>
        <from usec="0" sec="1218172388"/>
        <to usec="0" sec="1218172391"/>
    </anomaly>
    <anomaly type="anomalous" value="1.852810,1.841930,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="192.15.197.114" dst_port="139"/>
        </slice>
        <from usec="0" sec="1218171601"/>
        <to usec="0" sec="1218171607"/>
    </anomaly>
    <anomaly type="anomalous" value="1.852810,1.841930,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="213.5.45.12" dst_port="139"/>
        </slice>
        <from usec="0" sec="1218172265"/>
        <to usec="0" sec="1218172295"/>
    </anomaly>
    <anomaly type="anomalous" value="1.852810,1.841930,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="58.78.132.233" dst_port="23"/>
        </slice>
        <from usec="0" sec="1218172466"/>
        <to usec="0" sec="1218172501"/>
    </anomaly>
    <anomaly type="anomalous" value="1.852810,1.841930,999,1 1 1 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="150.239.93.205" dst_ip="219.216.200.70" src_port="2440" dst_port="53"/>
            <filter src_ip="150.239.93.205" dst_ip="42.35.9.66" src_port="1952" dst_port="25"/>
            <filter src_ip="150.239.93.205" dst_ip="213.17.12.119" src_port="3497" dst_port="18332"/>
        </slice>
        <from usec="0" sec="1218172485"/>
        <to usec="0" sec="1218172492"/>
    </anomaly>
    <anomaly type="anomalous" value="1.946300,1.851110,503,1 1 1 1 1 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="193.109.123.78" dst_ip="32.84.32.32" src_port="80"/>
            <filter src_ip="193.109.123.78" dst_ip="32.84.32.38" src_port="80"/>
            <filter src_ip="193.109.123.78" dst_ip="32.84.32.39" src_port="80"/>
        </slice>
        <from usec="0" sec="1218171601"/>
        <to usec="0" sec="1218172432"/>
    </anomaly>
    <anomaly type="anomalous" value="2.025730,1.919260,011,1 1 1 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="21.245.247.67" src_port="23"/>
        </slice>
        <from usec="0" sec="1218172456"/>
        <to usec="0" sec="1218172502"/>
    </anomaly>
    <anomaly type="anomalous" value="1.698290,1.481930,503,1 0 0 1 1 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="193.109.123.138" dst_ip="171.57.73.61"/>
            <filter src_ip="193.109.123.138" dst_ip="208.32.64.30"/>
            <filter src_ip="193.109.123.138" src_port="80"/>
            <filter src_ip="193.109.123.138" src_port="21"/>
            <filter dst_ip="208.32.64.30" src_port="21"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.991500,1.889270,999,1 1 1 1 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="203.13.175.230" src_port="53"/>
        </slice>
        <from usec="0" sec="1218171601"/>
        <to usec="0" sec="1218172498"/>
    </anomaly>
    <anomaly type="anomalous" value="1.546440,1.431080,503,1 0 0 1 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="150.239.105.152" dst_port="80"/>
            <filter src_ip="150.239.162.221" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.828240,2.284770,503,1 1 1 1 1 1 1 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="219.35.75.196" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.781080,1.657580,999,1 1 0 1 1 1 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="21.200.7.48" dst_ip="150.239.165.51" src_port="554" dst_port="3928"/>
            <filter src_ip="21.200.7.48" dst_ip="150.239.165.51" src_port="5004" dst_port="3930"/>
            <filter src_ip="21.200.7.48" dst_ip="150.239.147.133" src_port="554" dst_port="2598"/>
            <filter src_ip="21.200.7.48" dst_ip="150.239.147.133" src_port="5004" dst_port="2600"/>
            <filter src_ip="21.200.7.48" dst_ip="150.239.165.62" src_port="554" dst_port="3203"/>
        </slice>
        <from usec="0" sec="1218171625"/>
        <to usec="0" sec="1218172478"/>
    </anomaly>
    <anomaly type="anomalous" value="1.905430,1.821570,999,1 1 1 1 0 0 0 0 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="145.164.118.98" src_port="25"/>
            <filter src_ip="145.164.118.98" dst_port="25"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.776050,1.575550,503,0 0 0 1 1 1 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="36.242.134.22" src_port="80"/>
            <filter dst_ip="145.181.153.42" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.038540,1.706800,503,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="193.191.98.27" dst_ip="150.239.161.68"/>
            <filter dst_ip="150.239.161.68" src_port="80"/>
            <filter src_ip="193.191.98.27" dst_ip="150.239.0.72" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.462770,1.391430,503,0 0 0 1 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="150.239.110.229" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.038540,1.706800,503,0 0 0 1 1 1 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="150.239.184.141" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.038540,1.706800,503,0 0 0 1 1 1 0 0 0 1 1 1,mptplaHTTP">
        <slice>
            <filter dst_ip="150.239.91.39" src_port="53"/>
            <filter src_ip="193.191.98.64" dst_ip="150.239.91.39" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.038540,1.706800,503,0 0 0 1 1 1 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="145.164.250.251" dst_ip="18.217.70.148" src_port="80" dst_port="63680"/>
            <filter src_ip="145.164.250.251" dst_ip="18.217.70.148" src_port="80" dst_port="63660"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.794330,3.290520,999,0 0 0 1 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="150.239.166.78" dst_port="53"/>
        </slice>
        <from usec="0" sec="1218171601"/>
        <to usec="0" sec="1218172157"/>
    </anomaly>
    <anomaly type="anomalous" value="2.111580,1.928070,999,1 1 1 1 1 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.13.175.230" dst_port="53"/>
        </slice>
        <from usec="0" sec="1218171601"/>
        <to usec="0" sec="1218172501"/>
    </anomaly>
    <anomaly type="anomalous" value="3.812400,3.307830,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="175.58.231.115" dst_port="53"/>
        </slice>
        <from usec="0" sec="1218172411"/>
        <to usec="0" sec="1218172502"/>
    </anomaly>
    <anomaly type="anomalous" value="2.613960,2.355890,999,0 0 0 1 0 0 1 1 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="217.26.9.181" dst_ip="175.58.207.33" dst_port="3128"/>
            <filter src_ip="217.26.9.181" dst_ip="175.58.207.33" dst_port="3124"/>
        </slice>
        <from usec="0" sec="1218171601"/>
        <to usec="0" sec="1218172158"/>
    </anomaly>
    <anomaly type="anomalous" value="3.812400,3.307830,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="192.171.56.155" src_port="27115"/>
        </slice>
        <from usec="0" sec="1218171871"/>
        <to usec="0" sec="1218172457"/>
    </anomaly>
    <anomaly type="anomalous" value="3.812400,3.307830,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="175.58.231.115" dst_port="53"/>
        </slice>
        <from usec="0" sec="1218171601"/>
        <to usec="0" sec="1218171647"/>
    </anomaly>
    <anomaly type="anomalous" value="1.572910,1.509650,503,0 0 0 1 1 1 0 0 0 1 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="192.171.40.234" dst_ip="199.139.154.114" dst_port="80"/>
            <filter src_ip="175.58.46.92" dst_ip="199.139.154.114" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.038540,1.706800,503,0 0 0 1 1 1 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="145.164.84.37" dst_ip="21.102.208.2" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.038540,1.706800,503,0 0 0 1 1 1 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="150.239.105.152" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.038540,1.706800,503,0 0 0 1 1 1 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="150.239.68.147" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.038540,1.706800,503,0 0 0 1 1 1 0 0 0 1 1 1,mptplaHTTP">
        <slice>
            <filter src_ip="205.107.101.6" dst_ip="175.58.45.7" src_port="80" dst_port="54696"/>
            <filter src_ip="193.191.98.123" dst_ip="175.58.45.7" src_port="80" dst_port="54701"/>
            <filter src_ip="32.47.58.129" dst_ip="175.58.45.7" src_port="80" dst_port="54699"/>
            <filter src_ip="193.191.98.136" dst_ip="175.58.45.7" src_port="80" dst_port="54700"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.519680,1.458660,503,1 1 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="218.105.82.30" dst_ip="150.239.17.19" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.546440,1.431080,999,1 0 0 1 0 0 0 0 0 1 1 1,ntscUDP">
        <slice>
            <filter src_ip="192.171.48.103" src_port="7596"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.462770,1.391430,503,0 0 0 1 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="150.239.32.8" src_port="53"/>
            <filter dst_ip="150.239.32.8" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.038540,1.706800,503,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="199.139.154.114" src_port="80"/>
            <filter src_ip="193.191.98.29" dst_ip="192.161.35.97" src_port="80"/>
            <filter src_ip="193.191.98.29" dst_ip="145.164.211.184" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.277970,1.849690,503,1 1 0 1 1 1 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="219.35.75.196" dst_ip="203.157.105.127" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.038540,1.706800,999,0 0 0 1 1 1 0 0 0 1 1 1,ptmpla">
        <slice>
            <filter src_ip="150.239.111.8" src_port="53"/>
            <filter src_ip="150.239.111.8" dst_ip="210.49.246.67" dst_port="53"/>
            <filter src_ip="150.239.111.8" dst_ip="34.0.48.226" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.462770,1.391430,999,0 0 0 1 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="192.171.48.103" dst_port="7596"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.462770,1.391430,999,0 0 0 1 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="175.58.207.32" dst_ip="42.108.32.49"/>
            <filter src_ip="175.58.207.32" src_port="3124"/>
            <filter src_ip="175.58.207.32" src_port="3127"/>
            <filter src_ip="175.58.207.32" src_port="3128"/>
            <filter dst_ip="42.108.32.49" src_port="3124"/>
            <filter dst_ip="42.108.32.49" src_port="3127"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.038540,1.706800,503,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="150.239.20.29" src_port="80"/>
            <filter src_ip="193.191.98.180" dst_ip="145.42.219.72" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.462770,1.391430,503,0 0 0 1 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="150.239.61.106" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.817450,1.541130,503,0 0 0 1 1 0 1 0 0 1 1 1,mptmp">
        <slice>
            <filter src_port="80"/>
            <filter src_ip="195.205.18.236"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.038540,1.706800,503,0 0 0 1 1 1 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="145.164.118.46" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.462770,1.391430,503,0 0 0 1 0 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="193.109.113.149" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.622470,1.443680,503,0 0 0 1 1 0 0 0 0 1 1 1,mptplaHTTP">
        <slice>
            <filter src_ip="150.239.161.68" dst_ip="193.191.98.27" dst_port="80"/>
            <filter src_ip="150.239.0.72" dst_ip="193.191.98.27" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.462770,1.391430,503,0 0 0 1 0 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="150.239.68.147" dst_port="80"/>
            <filter src_ip="150.239.68.147" dst_port="20480"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.123220,1.344380,503,0 0 0 0 0 0 0 0 0 0 0 1,alphflHTTP">
        <slice>
            <filter src_ip="193.109.113.149" dst_ip="37.139.34.133" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.137460,1.372850,503,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="150.239.164.0" dst_ip="208.183.110.248" src_port="3215" dst_port="80"/>
            <filter src_ip="150.239.164.0" dst_ip="208.183.110.248" src_port="3214" dst_port="80"/>
            <filter src_ip="150.239.164.0" dst_ip="208.183.110.248" src_port="2463" dst_port="80"/>
            <filter src_ip="150.239.164.0" dst_ip="208.183.110.248" src_port="2462" dst_port="80"/>
        </slice>
        <from usec="0" sec="1218172467"/>
        <to usec="0" sec="1218172471"/>
    </anomaly>
    <anomaly type="suspicious" value="1.137460,1.372850,999,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="193.109.121.75" dst_ip="94.37.60.127" src_port="3232" dst_port="19100"/>
        </slice>
        <from usec="0" sec="1218172475"/>
        <to usec="0" sec="1218172479"/>
    </anomaly>
    <anomaly type="suspicious" value="1.137460,1.372850,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="175.58.19.73" dst_ip="34.93.217.115" src_port="4019" dst_port="80"/>
        </slice>
        <from usec="0" sec="1218172470"/>
        <to usec="0" sec="1218172495"/>
    </anomaly>
    <anomaly type="suspicious" value="1.137460,1.372850,503,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="150.239.41.196" dst_ip="221.216.28.150" src_port="3359" dst_port="80"/>
        </slice>
        <from usec="0" sec="1218172473"/>
        <to usec="0" sec="1218172479"/>
    </anomaly>
    <anomaly type="suspicious" value="1.137460,1.372850,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="175.58.63.242" dst_ip="199.139.154.77" src_port="2798" dst_port="80"/>
        </slice>
        <from usec="0" sec="1218172470"/>
        <to usec="0" sec="1218172474"/>
    </anomaly>
    <anomaly type="suspicious" value="1.137460,1.372850,999,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="39.30.162.104" dst_ip="175.58.207.47" src_port="4257" dst_port="8080"/>
        </slice>
        <from usec="0" sec="1218172486"/>
        <to usec="0" sec="1218172490"/>
    </anomaly>
    <anomaly type="suspicious" value="1.137460,1.372850,503,1 1 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="192.161.26.96" dst_ip="32.90.253.171" dst_port="80"/>
            <filter src_ip="192.161.26.96" dst_ip="32.15.157.37" dst_port="80"/>
            <filter src_ip="192.161.26.96" dst_ip="32.90.253.168" dst_port="80"/>
        </slice>
        <from usec="0" sec="1218172485"/>
        <to usec="0" sec="1218172501"/>
    </anomaly>
    <anomaly type="suspicious" value="1.137460,1.372850,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="192.171.32.228" dst_ip="34.93.210.40" src_port="1079" dst_port="80"/>
        </slice>
        <from usec="0" sec="1218172093"/>
        <to usec="0" sec="1218172102"/>
    </anomaly>
    <anomaly type="suspicious" value="1.137460,1.372850,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="209.123.80.196" dst_ip="150.239.32.25" dst_port="80"/>
        </slice>
        <from usec="0" sec="1218172100"/>
        <to usec="0" sec="1218172105"/>
    </anomaly>
    <anomaly type="suspicious" value="1.276370,1.387220,503,1 1 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="150.239.105.152" dst_ip="193.191.98.11" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.137460,1.372850,503,1 1 0 0 0 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="216.3.0.70" dst_ip="145.42.231.128" src_port="80"/>
            <filter src_ip="216.3.0.71" dst_ip="145.42.231.128" src_port="80"/>
        </slice>
        <from usec="0" sec="1218172476"/>
        <to usec="0" sec="1218172480"/>
    </anomaly>
    <anomaly type="suspicious" value="1.137460,1.372850,999,1 1 0 0 0 0 0 0 0 0 0 0,heavy_hitter">
        <slice>
            <filter src_ip="175.58.207.33" dst_ip="42.108.32.48" src_port="3127"/>
        </slice>
        <from usec="0" sec="1218172265"/>
        <to usec="0" sec="1218172492"/>
    </anomaly>
    <anomaly type="suspicious" value="1.137460,1.372850,002,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="48.70.232.186" src_port="1093" dst_port="137"/>
        </slice>
        <from usec="0" sec="1218172092"/>
        <to usec="0" sec="1218172105"/>
    </anomaly>
    <anomaly type="suspicious" value="1.137460,1.372850,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscICecrqICecrqdurmterp">
        <slice>
            <filter dst_ip="89.163.30.194"/>
        </slice>
        <from usec="0" sec="1218172188"/>
        <to usec="0" sec="1218172212"/>
    </anomaly>
    <anomaly type="suspicious" value="1.134110,1.304340,999,0 0 0 1 1 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="145.164.118.101" src_port="53"/>
            <filter dst_ip="145.164.118.101" dst_port="53"/>
        </slice>
        <from usec="0" sec="1218171601"/>
        <to usec="0" sec="1218172249"/>
    </anomaly>
    <anomaly type="suspicious" value="1.277140,1.285850,503,0 0 0 1 1 0 0 0 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="145.164.119.73" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.277140,1.285850,503,0 0 0 1 1 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="192.161.27.132" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.240160,1.346550,503,1 0 0 1 1 0 1 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="20.8.229.74" dst_ip="150.239.210.120" src_port="80"/>
        </slice>
        <from usec="0" sec="1218171601"/>
        <to usec="0" sec="1218172429"/>
    </anomaly>
    <anomaly type="suspicious" value="1.221310,1.345420,503,1 1 0 1 0 0 0 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="193.109.113.238" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.066950,1.226890,503,0 0 0 1 0 0 0 0 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="150.239.184.141" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.842539,1.189060,503,1 0 0 1 0 0 0 0 0 1 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="192.161.27.132" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.975085,1.204200,503,0 0 0 1 1 0 0 0 0 1 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="150.239.135.36" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.462450,1.496460,999,0 0 0 1 1 1 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="208.39.163.254" dst_ip="175.58.207.32"/>
            <filter src_ip="208.39.163.254" dst_ip="175.58.207.33"/>
            <filter src_ip="208.39.163.254" dst_port="3128"/>
            <filter src_ip="208.39.163.254" dst_port="3127"/>
            <filter src_ip="208.39.163.254" dst_port="6866"/>
            <filter src_ip="208.39.163.254" dst_port="3124"/>
            <filter dst_ip="175.58.207.32" dst_port="3128"/>
            <filter dst_ip="175.58.207.32" dst_port="3127"/>
            <filter dst_ip="175.58.207.32" dst_port="3124"/>
            <filter dst_ip="175.58.207.33" dst_port="3128"/>
            <filter dst_ip="175.58.207.33" dst_port="3124"/>
        </slice>
        <from usec="0" sec="1218171634"/>
        <to usec="0" sec="1218171889"/>
    </anomaly>
    <anomaly type="suspicious" value="0.890786,1.246260,020,0 0 0 1 0 0 1 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="193.109.113.157"/>
        </slice>
        <from usec="0" sec="1218171601"/>
        <to usec="0" sec="1218172427"/>
    </anomaly>
    <anomaly type="suspicious" value="0.964895,1.291270,020,0 0 0 0 0 0 1 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="33.34.195.193"/>
        </slice>
        <from usec="0" sec="1218171601"/>
        <to usec="0" sec="1218171647"/>
    </anomaly>
    <anomaly type="suspicious" value="0.964895,1.291270,999,0 0 0 0 0 0 1 0 0 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="221.194.57.139" dst_ip="150.239.147.213"/>
        </slice>
        <from usec="0" sec="1218171601"/>
        <to usec="0" sec="1218171647"/>
    </anomaly>
    <anomaly type="suspicious" value="0.964895,1.291270,002,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_port="1026" dst_port="137"/>
        </slice>
        <from usec="0" sec="1218171601"/>
        <to usec="0" sec="1218171647"/>
    </anomaly>
    <anomaly type="suspicious" value="0.964895,1.291270,999,0 0 0 0 0 0 1 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="175.58.231.115" dst_ip="200.107.39.242" dst_port="53"/>
        </slice>
        <from usec="0" sec="1218171736"/>
        <to usec="0" sec="1218171782"/>
    </anomaly>
    <anomaly type="suspicious" value="0.890786,1.246260,999,0 0 0 1 0 0 1 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="217.82.175.21" dst_ip="169.19.166.6" src_port="53"/>
            <filter src_ip="217.82.175.21" dst_ip="169.19.167.64" src_port="53"/>
        </slice>
        <from usec="0" sec="1218171601"/>
        <to usec="0" sec="1218172457"/>
    </anomaly>
    <anomaly type="suspicious" value="0.964895,1.291270,999,0 0 0 0 0 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="192.161.0.248"/>
        </slice>
        <from usec="0" sec="1218171916"/>
        <to usec="0" sec="1218171962"/>
    </anomaly>
    <anomaly type="suspicious" value="0.964895,1.291270,999,0 0 0 0 0 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="145.164.164.167"/>
        </slice>
        <from usec="0" sec="1218171916"/>
        <to usec="0" sec="1218171962"/>
    </anomaly>
    <anomaly type="suspicious" value="1.062450,1.262070,999,0 0 0 1 0 0 1 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="175.58.207.47" dst_port="53"/>
            <filter src_ip="175.58.231.115" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.890786,1.246260,999,0 0 0 1 0 0 1 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="150.239.141.241" dst_port="53"/>
            <filter dst_ip="106.152.170.71" src_port="53"/>
        </slice>
        <from usec="0" sec="1218171735"/>
        <to usec="0" sec="1218172057"/>
    </anomaly>
    <anomaly type="suspicious" value="0.964895,1.291270,020,0 0 0 0 0 0 1 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="89.163.30.194"/>
        </slice>
        <from usec="0" sec="1218171871"/>
        <to usec="0" sec="1218171962"/>
    </anomaly>
    <anomaly type="suspicious" value="0.964895,1.291270,020,0 0 0 0 0 0 1 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="24.176.137.180"/>
        </slice>
        <from usec="0" sec="1218171916"/>
        <to usec="0" sec="1218171962"/>
    </anomaly>
    <anomaly type="suspicious" value="0.964895,1.291270,999,0 0 0 0 0 0 1 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="145.164.103.186" dst_ip="34.0.48.56" dst_port="53"/>
        </slice>
        <from usec="0" sec="1218171916"/>
        <to usec="0" sec="1218171962"/>
    </anomaly>
    <anomaly type="suspicious" value="0.964895,1.291270,020,0 0 0 0 0 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="175.58.207.34"/>
        </slice>
        <from usec="0" sec="1218171916"/>
        <to usec="0" sec="1218171962"/>
    </anomaly>
    <anomaly type="suspicious" value="0.964895,1.291270,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="192.171.49.85"/>
        </slice>
        <from usec="0" sec="1218171916"/>
        <to usec="0" sec="1218171962"/>
    </anomaly>
    <anomaly type="suspicious" value="0.964895,1.291270,999,0 0 0 0 0 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="150.239.57.135"/>
        </slice>
        <from usec="0" sec="1218171916"/>
        <to usec="0" sec="1218171962"/>
    </anomaly>
    <anomaly type="suspicious" value="0.964895,1.291270,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="175.58.44.150"/>
        </slice>
        <from usec="0" sec="1218171916"/>
        <to usec="0" sec="1218171962"/>
    </anomaly>
    <anomaly type="suspicious" value="0.964895,1.291270,999,0 0 0 0 0 0 1 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="217.82.170.99" dst_ip="169.19.174.193"/>
        </slice>
        <from usec="0" sec="1218171916"/>
        <to usec="0" sec="1218171962"/>
    </anomaly>
    <anomaly type="suspicious" value="0.964895,1.291270,999,0 0 0 0 0 0 1 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="217.82.170.99" dst_ip="169.19.166.6" dst_port="53"/>
        </slice>
        <from usec="0" sec="1218171916"/>
        <to usec="0" sec="1218171962"/>
    </anomaly>
    <anomaly type="suspicious" value="0.964895,1.291270,999,0 0 0 0 0 0 1 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="217.82.170.100" dst_ip="169.19.174.193"/>
        </slice>
        <from usec="0" sec="1218171916"/>
        <to usec="0" sec="1218171962"/>
    </anomaly>
    <anomaly type="suspicious" value="0.964895,1.291270,999,0 0 0 0 0 0 1 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="217.82.170.100" dst_ip="169.19.166.6" dst_port="53"/>
        </slice>
        <from usec="0" sec="1218171916"/>
        <to usec="0" sec="1218171962"/>
    </anomaly>
    <anomaly type="suspicious" value="0.964895,1.291270,999,0 0 0 0 0 0 1 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="217.82.170.102" dst_ip="169.19.166.6" dst_port="53"/>
        </slice>
        <from usec="0" sec="1218171916"/>
        <to usec="0" sec="1218171962"/>
    </anomaly>
    <anomaly type="suspicious" value="0.964895,1.291270,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="172.14.24.209" dst_port="19872"/>
        </slice>
        <from usec="0" sec="1218171736"/>
        <to usec="0" sec="1218172097"/>
    </anomaly>
    <anomaly type="suspicious" value="1.240160,1.346550,999,1 0 0 1 1 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="145.164.118.98" dst_port="25"/>
        </slice>
        <from usec="0" sec="1218171601"/>
        <to usec="0" sec="1218172492"/>
    </anomaly>
    <anomaly type="suspicious" value="1.087570,1.333890,504,1 0 0 0 0 0 1 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="150.239.149.18" dst_ip="95.54.72.19" dst_port="443"/>
        </slice>
        <from usec="0" sec="1218172051"/>
        <to usec="0" sec="1218172282"/>
    </anomaly>
    <anomaly type="suspicious" value="0.975085,1.204200,503,0 0 0 1 1 0 0 0 0 1 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="150.239.32.25" dst_ip="215.226.238.0" src_port="80"/>
            <filter src_ip="150.239.32.25" dst_ip="209.123.80.196" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.066950,1.226890,503,0 0 0 1 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="150.239.91.39" dst_port="80"/>
            <filter dst_ip="193.191.98.68" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.842539,1.189060,503,1 0 0 1 0 0 0 0 0 1 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="193.109.125.42" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.975085,1.204200,503,0 0 0 1 1 0 0 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="150.239.213.13" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.129560,1.272590,503,0 0 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter dst_ip="145.164.134.182" src_port="80"/>
            <filter src_ip="193.191.98.118" dst_ip="150.239.11.98" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.129560,1.272590,503,0 0 0 0 0 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter src_ip="93.158.150.82" dst_ip="192.161.26.102" src_port="80"/>
            <filter src_ip="54.122.20.191" dst_ip="192.161.26.102" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.842539,1.189060,502,1 0 0 1 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter src_ip="48.144.10.61" dst_ip="192.161.27.220" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.890786,1.246260,503,0 0 0 1 0 0 1 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="150.239.184.141" dst_port="80"/>
            <filter src_ip="150.239.130.166" dst_port="80"/>
        </slice>
        <from usec="0" sec="1218171604"/>
        <to usec="0" sec="1218172249"/>
    </anomaly>
    <anomaly type="suspicious" value="0.920540,1.236160,504,1 0 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter src_ip="145.164.101.111" dst_ip="196.166.171.15" src_port="63976" dst_port="443"/>
            <filter src_ip="145.164.101.111" dst_ip="196.166.171.15" src_port="61848" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.066950,1.226890,999,0 0 0 1 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="106.156.180.10" dst_port="5354"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.066950,1.226890,503,0 0 0 1 0 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter dst_ip="145.42.216.0" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.129560,1.272590,503,0 0 0 0 0 0 0 0 0 1 1 0,ptmplaHTTP">
        <slice>
            <filter src_ip="199.139.154.77" dst_ip="172.14.18.128" src_port="80" dst_port="4040"/>
            <filter src_ip="199.139.154.77" dst_ip="192.161.8.178" src_port="80" dst_port="2461"/>
            <filter src_ip="199.139.154.77" dst_ip="175.58.63.242" src_port="80" dst_port="2798"/>
            <filter src_ip="199.139.154.77" dst_ip="175.58.62.11" src_port="80" dst_port="64624"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.129560,1.272590,503,0 0 0 0 0 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter src_ip="36.241.85.126" dst_ip="150.239.86.107" src_port="80"/>
            <filter src_ip="32.47.58.129" dst_ip="150.239.86.107" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
