<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="anomalous" value="1.399140,1.319560,503,1 1 0 1 0 0 0 0 0 1 0 1,mptmp">
        <slice>
            <filter src_ip="142.243.50.21" dst_port="80"/>
            <filter src_ip="162.73.232.37" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.381990,1.356950,999,1 1 0 1 1 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="212.21.138.195" dst_port="3128"/>
            <filter dst_ip="212.21.138.195" dst_port="80"/>
            <filter dst_ip="212.21.138.195" dst_port="3124"/>
        </slice>
        <from usec="0" sec="1223614801"/>
        <to usec="0" sec="1223615699"/>
    </anomaly>
    <anomaly type="anomalous" value="1.614510,1.362960,503,1 1 0 1 0 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="136.228.199.46" dst_port="80"/>
            <filter src_ip="136.228.199.46" dst_port="20480"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.937290,1.725700,503,1 1 1 1 1 0 0 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="162.73.46.187" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.849570,1.688000,503,1 0 1 1 1 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="142.243.74.29" dst_port="80"/>
            <filter dst_ip="212.138.109.144" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.771910,1.392430,503,1 1 0 1 1 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="213.33.144.180" dst_ip="210.192.150.159" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.806020,1.736140,503,1 1 1 0 0 0 0 0 0 1 0 0,salphfl">
        <slice>
            <filter src_ip="136.228.233.114" dst_ip="221.82.112.27" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.432960,1.958270,020,1 0 0 1 1 1 0 0 0 1 1 1,icmp_error">
        <slice>
            <filter src_ip="136.228.193.49" dst_port="80"/>
            <filter src_ip="136.228.193.71" dst_port="80"/>
            <filter dst_ip="20.98.132.27"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.206120,1.821370,503,1 1 1 1 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="212.21.132.27" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.991990,1.496230,999,1 1 0 1 1 0 1 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="142.243.51.132" src_port="25"/>
            <filter src_ip="142.243.51.132" dst_port="25"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.806020,1.736140,503,1 1 1 0 0 0 0 0 0 1 0 0,salphfl">
        <slice>
            <filter src_ip="136.228.120.112" dst_ip="208.226.55.240" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.977560,1.769350,503,1 1 1 0 0 0 0 0 0 1 1 0,ptmplaHTTP">
        <slice>
            <filter src_ip="162.73.221.31" dst_ip="211.70.108.106" dst_port="80"/>
            <filter src_ip="162.73.221.31" dst_ip="213.43.44.108" dst_port="80"/>
            <filter src_ip="162.73.221.31" dst_ip="8.186.15.103" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.974200,2.425580,999,1 1 0 1 1 0 1 1 1 1 0 0,ntscUDP">
        <slice>
            <filter src_ip="216.77.71.197" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.268400,1.246410,010,1 1 0 1 0 0 0 0 0 1 1 0,ntscSYNt">
        <slice>
            <filter src_ip="193.138.87.130" dst_port="21"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.991990,1.496230,503,1 1 0 1 1 0 1 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="213.42.166.8" dst_port="53"/>
            <filter src_ip="213.42.166.8" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.828080,1.732400,503,1 1 1 1 1 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="213.33.63.13" dst_port="80"/>
        </slice>
        <from usec="0" sec="1223614801"/>
        <to usec="0" sec="1223615603"/>
    </anomaly>
    <anomaly type="anomalous" value="2.323790,1.843530,503,1 1 1 1 1 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="213.33.57.14" dst_port="80"/>
            <filter src_ip="213.33.57.14" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.828080,1.732400,503,1 1 1 1 1 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="212.21.136.148" dst_port="80"/>
        </slice>
        <from usec="0" sec="1223614801"/>
        <to usec="0" sec="1223615655"/>
    </anomaly>
    <anomaly type="anomalous" value="2.103630,1.801280,999,1 1 0 1 0 0 1 1 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="212.21.138.195" src_port="3128"/>
            <filter src_ip="212.21.138.195" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.206120,1.821370,503,1 1 1 1 0 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="213.33.60.210" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.270310,2.714100,010,1 1 1 1 1 0 1 1 1 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="118.130.33.58" dst_port="23"/>
        </slice>
        <from usec="0" sec="1223614844"/>
        <to usec="0" sec="1223615501"/>
    </anomaly>
    <anomaly type="anomalous" value="1.675550,1.345420,503,1 0 0 1 1 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="136.228.68.30" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.723430,1.390880,999,1 1 0 1 1 0 1 0 0 1 1 0,ptpposcaUDP">
        <slice>
            <filter src_ip="200.92.136.3" dst_ip="162.73.189.209"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.495660,1.923130,503,1 1 1 1 1 0 1 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="136.228.85.93" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.432960,1.958270,503,1 0 0 1 1 1 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="213.33.57.14" src_port="80"/>
            <filter dst_ip="213.33.57.14" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.513530,1.377090,503,0 0 0 0 0 0 0 0 0 1 1 1,mptplaHTTP">
        <slice>
            <filter dst_ip="136.228.164.60" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.675550,1.345420,503,1 0 0 1 1 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="136.228.150.150" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.917820,2.398900,999,1 0 0 1 1 0 1 1 1 1 0 0,mptmp">
        <slice>
            <filter src_ip="162.73.46.218"/>
            <filter src_ip="162.73.46.212"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.345240,1.227200,503,1 0 0 1 1 0 0 0 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="212.21.136.148" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.206120,1.821370,503,1 1 1 1 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="136.228.172.21" dst_ip="212.138.109.128"/>
            <filter src_ip="136.228.172.21" dst_port="80"/>
            <filter dst_ip="212.138.109.128" dst_port="80"/>
            <filter dst_ip="40.173.128.75" src_port="123" dst_port="123"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.053010,1.794510,999,1 0 0 1 1 0 1 1 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="142.16.161.174" dst_port="53"/>
            <filter src_ip="162.73.17.67" dst_ip="213.176.156.88" dst_port="53"/>
            <filter src_ip="162.73.17.67" dst_ip="213.176.145.148" dst_port="53"/>
        </slice>
        <from usec="0" sec="1223614801"/>
        <to usec="0" sec="1223615537"/>
    </anomaly>
    <anomaly type="anomalous" value="2.609090,2.192870,999,1 1 1 1 1 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="216.77.71.197" dst_port="53"/>
        </slice>
        <from usec="0" sec="1223614801"/>
        <to usec="0" sec="1223615699"/>
    </anomaly>
    <anomaly type="anomalous" value="2.495660,1.923130,503,1 1 1 1 1 0 1 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="212.21.143.9" dst_port="80"/>
            <filter dst_ip="212.21.143.8" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.907140,1.794390,010,1 1 1 1 0 0 1 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="213.190.78.212" dst_port="139"/>
        </slice>
        <from usec="0" sec="1223614801"/>
        <to usec="0" sec="1223615616"/>
    </anomaly>
    <anomaly type="anomalous" value="2.053010,1.794510,999,1 0 0 1 1 0 1 1 0 0 0 0,rflatDNS">
        <slice>
            <filter dst_ip="164.25.79.32" dst_port="53"/>
            <filter src_ip="192.89.128.211" dst_ip="164.25.79.32" src_port="53"/>
            <filter src_ip="192.89.130.101" dst_ip="164.25.79.32" src_port="53"/>
        </slice>
        <from usec="0" sec="1223614801"/>
        <to usec="0" sec="1223615629"/>
    </anomaly>
    <anomaly type="anomalous" value="1.463510,1.278560,503,1 1 0 1 1 0 0 0 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="162.73.46.187" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.427750,1.971020,503,0 0 0 1 1 1 0 0 0 1 1 1,ptmplaHTTP">
        <slice>
            <filter src_ip="194.173.188.64" dst_ip="136.228.210.92" src_port="80" dst_port="1380"/>
            <filter src_ip="194.173.188.64" dst_ip="136.228.138.11" src_port="80" dst_port="3652"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.427750,1.971020,503,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="210.192.150.138" src_port="80"/>
            <filter src_ip="210.192.150.159" dst_ip="213.33.144.180" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.056160,2.392300,999,1 1 1 1 1 1 1 0 0 1 1 1,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="212.21.133.44" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.427750,1.971020,503,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="142.47.173.222" dst_ip="195.136.224.148"/>
            <filter src_ip="142.47.173.222" src_port="80"/>
            <filter dst_ip="195.136.224.148" src_port="53"/>
            <filter dst_ip="195.136.224.148" src_port="80"/>
            <filter src_ip="142.47.173.222" dst_ip="119.177.68.118" dst_port="81"/>
            <filter src_ip="142.47.173.222" dst_ip="193.162.104.49" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.345240,1.227200,503,1 0 0 1 1 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="142.16.165.103" dst_port="80"/>
            <filter dst_ip="142.16.165.103" src_port="123" dst_port="123"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.427750,1.971020,503,0 0 0 1 1 1 0 0 0 1 1 1,ptmplaHTTP">
        <slice>
            <filter src_ip="142.226.86.46" dst_ip="107.100.252.137" src_port="80" dst_port="35842"/>
            <filter src_ip="142.226.86.46" dst_ip="107.100.252.138" src_port="80" dst_port="48567"/>
            <filter src_ip="142.226.86.46" dst_ip="96.16.224.225" src_port="80" dst_port="54529"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.432960,1.958270,503,1 0 0 1 1 1 0 0 0 1 1 1,heavy_hitter">
        <slice>
            <filter src_ip="143.36.200.34" dst_ip="136.228.80.36" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.667990,1.363910,503,0 0 0 1 1 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="195.144.141.205" dst_ip="136.228.104.144" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.432960,1.958270,503,1 0 0 1 1 1 0 0 0 1 1 1,heavy_hitter">
        <slice>
            <filter src_ip="139.40.98.102" dst_ip="142.16.146.29" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.053010,1.794510,999,1 0 0 1 1 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="164.25.78.127" src_port="53"/>
            <filter dst_ip="164.25.78.127" dst_port="53"/>
        </slice>
        <from usec="0" sec="1223614801"/>
        <to usec="0" sec="1223615629"/>
    </anomaly>
    <anomaly type="anomalous" value="2.754220,2.421600,010,0 0 0 0 0 0 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="99.44.51.236" src_port="80" dst_port="1024"/>
            <filter src_ip="99.44.51.236" src_port="80" dst_port="3072"/>
        </slice>
        <from usec="0" sec="1223615116"/>
        <to usec="0" sec="1223615252"/>
    </anomaly>
    <anomaly type="anomalous" value="1.923050,1.818380,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="213.33.146.9" src_port="9338"/>
        </slice>
        <from usec="0" sec="1223614801"/>
        <to usec="0" sec="1223614847"/>
    </anomaly>
    <anomaly type="anomalous" value="1.923050,1.818380,010,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="213.33.146.9" dst_port="9338"/>
        </slice>
        <from usec="0" sec="1223614801"/>
        <to usec="0" sec="1223614847"/>
    </anomaly>
    <anomaly type="anomalous" value="2.754220,2.421600,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="204.182.26.70" src_port="1040" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1223615161"/>
        <to usec="0" sec="1223615207"/>
    </anomaly>
    <anomaly type="anomalous" value="2.754220,2.421600,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="19.170.220.196" src_port="1050" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1223615161"/>
        <to usec="0" sec="1223615207"/>
    </anomaly>
    <anomaly type="anomalous" value="2.754220,2.421600,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="204.182.131.74" src_port="1109" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1223615161"/>
        <to usec="0" sec="1223615207"/>
    </anomaly>
    <anomaly type="anomalous" value="2.754220,2.421600,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="21.77.52.155" src_port="1141" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1223615161"/>
        <to usec="0" sec="1223615207"/>
    </anomaly>
    <anomaly type="anomalous" value="2.754220,2.421600,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="213.179.252.136" src_port="1231" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1223615161"/>
        <to usec="0" sec="1223615207"/>
    </anomaly>
    <anomaly type="anomalous" value="2.746650,2.397250,999,0 0 0 1 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="204.204.183.101" src_port="2229" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1223614801"/>
        <to usec="0" sec="1223615449"/>
    </anomaly>
    <anomaly type="anomalous" value="2.754220,2.421600,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="21.122.35.74" src_port="2340" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1223615161"/>
        <to usec="0" sec="1223615207"/>
    </anomaly>
    <anomaly type="anomalous" value="2.754220,2.421600,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="213.185.48.59" src_port="2973" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1223615161"/>
        <to usec="0" sec="1223615207"/>
    </anomaly>
    <anomaly type="anomalous" value="2.754220,2.421600,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="204.183.128.90" src_port="3131" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1223615161"/>
        <to usec="0" sec="1223615207"/>
    </anomaly>
    <anomaly type="anomalous" value="2.842030,2.414130,999,0 0 0 1 1 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="162.73.211.207" src_port="20129"/>
            <filter src_ip="162.73.211.207" dst_port="20129"/>
            <filter src_ip="162.73.198.7" src_port="20129" dst_port="20129"/>
        </slice>
        <from usec="0" sec="1223614801"/>
        <to usec="0" sec="1223615627"/>
    </anomaly>
    <anomaly type="anomalous" value="1.508120,1.314900,999,1 0 0 1 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="136.228.209.143" src_port="53"/>
            <filter src_ip="142.243.50.77" dst_ip="96.16.208.211" dst_port="25"/>
            <filter src_ip="136.228.65.90" dst_ip="96.16.208.211" dst_port="25"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.667990,1.363910,503,0 0 0 1 1 0 0 0 0 1 1 1,salphfl">
        <slice>
            <filter src_ip="162.73.20.4" dst_ip="213.43.73.160" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.427750,1.971020,503,0 0 0 1 1 1 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="212.138.109.128" dst_ip="136.228.172.21" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.427750,1.971020,503,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="98.149.212.7" src_port="80"/>
            <filter dst_ip="213.33.60.210" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.432960,1.958270,503,1 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="104.31.129.41" src_port="80"/>
            <filter src_ip="142.76.16.31" src_port="80"/>
            <filter dst_ip="136.228.237.235" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.427750,1.971020,503,0 0 0 1 1 1 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="195.146.192.226" dst_ip="136.228.150.150" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.499710,1.333820,503,0 0 0 1 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="136.228.216.133" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.771910,1.392430,503,1 1 0 1 1 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="212.21.143.9" src_port="80"/>
            <filter src_ip="212.21.143.8" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.432960,1.958270,503,1 0 0 1 1 1 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="142.243.151.3" dst_ip="204.105.128.198" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.667990,1.363910,503,0 0 0 1 1 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="136.228.138.11"/>
            <filter src_ip="212.138.109.123" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.499710,1.333820,503,0 0 0 1 0 0 0 0 0 1 1 1,mptplaHTTP">
        <slice>
            <filter src_ip="107.116.137.48" dst_ip="136.228.86.43" src_port="80"/>
            <filter src_ip="96.45.253.229" dst_ip="136.228.86.43" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.427750,1.971020,503,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="194.173.188.69" dst_ip="136.228.172.18"/>
            <filter src_ip="194.173.188.69" src_port="80"/>
            <filter dst_ip="136.228.172.18" src_port="80"/>
            <filter dst_ip="136.228.172.18" src_port="123" dst_port="123"/>
            <filter dst_ip="136.228.172.18" src_port="53" dst_port="32768"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.521860,1.358780,503,1 0 0 0 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="142.228.95.21" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.754270,1.441840,503,0 0 0 1 0 0 1 0 0 1 1 1,salphfl">
        <slice>
            <filter src_ip="212.106.108.47" dst_ip="142.228.95.22" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.627350,1.405340,503,1 1 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="212.21.132.27" src_port="80"/>
            <filter src_ip="162.73.46.178" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.427750,1.971020,503,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="21.220.25.194" dst_ip="213.33.138.98"/>
            <filter src_ip="21.220.25.194" src_port="80"/>
            <filter src_ip="142.65.137.26" dst_ip="213.33.138.98" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.335800,1.247450,503,0 0 0 1 1 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="213.33.63.13" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.983070,3.128640,010,1 1 1 1 1 1 1 1 1 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="205.111.163.190" src_port="6000" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.268400,1.246410,503,1 1 0 1 0 0 0 0 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="136.228.68.30" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.206120,1.821370,503,1 1 1 1 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="213.33.62.158" dst_port="80"/>
            <filter dst_ip="98.149.208.6" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.627350,1.405340,503,1 1 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="136.228.19.20" dst_ip="212.138.109.117" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.513530,1.377090,503,0 0 0 0 0 0 0 0 0 1 1 1,salphfl">
        <slice>
            <filter src_ip="136.228.86.43" dst_ip="220.201.1.144" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.206120,1.821370,503,1 1 1 1 0 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="136.228.237.235" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.500300,1.990860,503,1 1 0 1 1 1 0 0 0 1 1 1,heavy_hitter">
        <slice>
            <filter src_ip="136.228.80.36" dst_ip="143.36.200.34" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.432960,1.958270,503,1 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="136.228.85.93" src_port="80"/>
            <filter dst_ip="136.228.85.91" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.521860,1.358780,503,1 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="195.162.149.183" dst_ip="136.228.86.37" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.513530,1.377090,010,0 0 0 0 0 0 0 0 0 1 1 1,sptpDoSSYN">
        <slice>
            <filter src_ip="203.114.5.55" dst_ip="213.33.130.212" dst_port="51413"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.513530,1.377090,503,0 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="212.138.109.0" dst_ip="142.243.10.64" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.499710,1.333820,503,0 0 0 1 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="142.243.50.21" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.268400,1.246410,503,1 1 0 1 0 0 0 0 0 1 1 0,heavy_hitter">
        <slice>
            <filter src_ip="21.70.40.139" dst_ip="162.73.46.212" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.513530,1.377090,503,0 0 0 0 0 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="136.228.64.31" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.508120,1.314900,503,1 0 0 1 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="213.42.166.8" src_port="53"/>
            <filter dst_ip="213.42.166.8" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.513530,1.377090,503,0 0 0 0 0 0 0 0 0 1 1 1,mptplaHTTP">
        <slice>
            <filter src_ip="136.228.214.244" dst_ip="212.138.109.18" src_port="4706" dst_port="80"/>
            <filter src_ip="136.228.214.244" dst_ip="212.138.109.18" src_port="4604" dst_port="80"/>
            <filter src_ip="136.228.164.60" dst_ip="212.138.109.18" src_port="37339" dst_port="80"/>
            <filter src_ip="136.228.164.60" dst_ip="212.138.109.18" src_port="37332" dst_port="80"/>
            <filter src_ip="136.228.237.131" dst_ip="212.138.109.18" src_port="47957" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.513530,1.377090,503,0 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="142.226.175.233" dst_ip="107.100.243.87" src_port="80" dst_port="53600"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.499710,1.333820,503,0 0 0 1 0 0 0 0 0 1 1 1,ptmplaHTTP">
        <slice>
            <filter src_ip="136.228.80.8" dst_ip="107.100.242.105" src_port="80"/>
            <filter src_ip="136.228.80.8" dst_ip="99.29.207.178" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.513530,1.377090,503,0 0 0 0 0 0 0 0 0 1 1 1,mptplaHTTP">
        <slice>
            <filter dst_ip="142.243.10.143" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.513530,1.377090,503,0 0 0 0 0 0 0 0 0 1 1 1,mptplaHTTP">
        <slice>
            <filter src_ip="137.87.97.92" dst_ip="107.100.253.0" src_port="80"/>
            <filter src_ip="142.243.51.208" dst_ip="107.100.253.0" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.173400,1.326690,503,1 1 0 1 0 0 1 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="213.42.135.210" dst_ip="107.4.66.12" dst_port="80"/>
        </slice>
        <from usec="0" sec="1223614802"/>
        <to usec="0" sec="1223615699"/>
    </anomaly>
    <anomaly type="suspicious" value="1.191000,1.370200,010,1 1 0 0 0 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="213.42.134.4" dst_port="25"/>
        </slice>
        <from usec="0" sec="1223614873"/>
        <to usec="0" sec="1223615255"/>
    </anomaly>
    <anomaly type="suspicious" value="0.979681,1.198800,503,1 1 0 1 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="160.49.3.255" dst_ip="40.94.172.209" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.191000,1.370200,010,1 1 0 0 0 0 1 0 0 0 0 0,sptpDoSSYN">
        <slice>
            <filter src_ip="121.17.219.104" dst_ip="142.243.51.209" dst_port="80"/>
        </slice>
        <from usec="0" sec="1223614942"/>
        <to usec="0" sec="1223615153"/>
    </anomaly>
    <anomaly type="suspicious" value="1.675960,1.708800,503,1 1 1 1 0 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="162.73.190.132" dst_ip="212.138.109.51"/>
            <filter src_ip="162.73.190.132" dst_ip="50.80.27.145" dst_port="80"/>
            <filter src_ip="136.228.214.244" dst_ip="212.138.109.51" dst_port="80"/>
        </slice>
        <from usec="0" sec="1223615097"/>
        <to usec="0" sec="1223615629"/>
    </anomaly>
    <anomaly type="suspicious" value="0.818037,1.194040,503,1 0 0 0 0 0 0 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="23.37.130.191" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.173400,1.326690,999,1 1 0 1 0 0 1 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="142.243.51.236" dst_port="53"/>
            <filter dst_ip="216.178.77.100" dst_port="53"/>
        </slice>
        <from usec="0" sec="1223614801"/>
        <to usec="0" sec="1223615643"/>
    </anomaly>
    <anomaly type="suspicious" value="1.284700,1.292620,503,1 1 0 0 0 0 0 0 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="162.73.76.174" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.966686,1.219520,999,0 1 0 1 0 0 0 0 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="162.73.189.236" src_port="1889"/>
            <filter src_ip="162.73.189.236" src_port="8512"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.979681,1.198800,503,1 1 0 1 0 0 0 0 0 1 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="136.228.138.11" src_port="24454"/>
            <filter src_ip="136.228.138.11" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.688330,1.742790,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="69.96.174.203" dst_port="8080"/>
        </slice>
        <from usec="0" sec="1223614801"/>
        <to usec="0" sec="1223614810"/>
    </anomaly>
    <anomaly type="suspicious" value="1.039980,1.241560,504,1 1 0 1 1 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="208.31.10.157" dst_port="443"/>
        </slice>
        <from usec="0" sec="1223614801"/>
        <to usec="0" sec="1223615610"/>
    </anomaly>
    <anomaly type="suspicious" value="1.586900,1.705470,503,1 0 1 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="21.48.23.176" dst_ip="212.21.129.87" src_port="46086" dst_port="80"/>
            <filter src_ip="21.48.23.176" dst_ip="136.228.102.192" src_port="44969" dst_port="80"/>
            <filter src_ip="21.48.23.176" dst_ip="136.228.80.8" src_port="44442" dst_port="80"/>
            <filter src_ip="21.48.23.176" dst_ip="136.228.80.31" src_port="45050" dst_port="8888"/>
        </slice>
        <from usec="0" sec="1223615096"/>
        <to usec="0" sec="1223615099"/>
    </anomaly>
    <anomaly type="suspicious" value="1.688330,1.742790,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="202.107.49.140" dst_port="139"/>
        </slice>
        <from usec="0" sec="1223614803"/>
        <to usec="0" sec="1223614820"/>
    </anomaly>
    <anomaly type="suspicious" value="1.077310,1.178810,503,1 0 0 1 1 0 0 0 0 1 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="136.228.237.234" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.173400,1.326690,999,1 1 0 1 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="136.228.237.233"/>
        </slice>
        <from usec="0" sec="1223614801"/>
        <to usec="0" sec="1223615431"/>
    </anomaly>
    <anomaly type="suspicious" value="1.022090,1.277260,020,1 0 0 1 0 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="54.156.250.193" dst_port="139"/>
            <filter src_ip="54.156.250.193"/>
        </slice>
        <from usec="0" sec="1223614801"/>
        <to usec="0" sec="1223615633"/>
    </anomaly>
    <anomaly type="suspicious" value="1.191000,1.370200,010,1 1 0 0 0 0 1 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="205.115.171.175" dst_ip="212.21.138.202" dst_port="3128"/>
            <filter src_ip="205.115.171.175" dst_ip="212.21.138.195" dst_port="3128"/>
        </slice>
        <from usec="0" sec="1223614804"/>
        <to usec="0" sec="1223615698"/>
    </anomaly>
    <anomaly type="suspicious" value="0.865654,1.188600,999,1 0 0 1 1 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="142.243.216.213"/>
        </slice>
        <from usec="0" sec="1223614801"/>
        <to usec="0" sec="1223615539"/>
    </anomaly>
    <anomaly type="suspicious" value="0.865654,1.188600,999,1 0 0 1 1 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="142.243.189.146" dst_ip="193.52.116.254" src_port="1680" dst_port="1935"/>
            <filter src_ip="142.243.189.146" dst_ip="206.180.213.198" src_port="4136" dst_port="80"/>
        </slice>
        <from usec="0" sec="1223614801"/>
        <to usec="0" sec="1223615461"/>
    </anomaly>
    <anomaly type="suspicious" value="1.022090,1.277260,999,1 0 0 1 0 0 1 0 0 0 0 0,mptmp">
        <slice>
            <filter dst_ip="142.243.51.132" dst_port="25"/>
            <filter dst_ip="142.243.51.0" dst_port="25"/>
        </slice>
        <from usec="0" sec="1223614801"/>
        <to usec="0" sec="1223615699"/>
    </anomaly>
    <anomaly type="suspicious" value="1.039980,1.241560,999,1 1 0 1 1 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter dst_ip="164.25.78.120" src_port="25"/>
            <filter dst_ip="164.25.78.120" dst_port="25"/>
            <filter dst_ip="164.25.30.99" dst_port="25"/>
        </slice>
        <from usec="0" sec="1223614801"/>
        <to usec="0" sec="1223615629"/>
    </anomaly>
    <anomaly type="suspicious" value="0.850920,1.209490,020,0 0 0 1 1 0 0 0 0 0 0 0,icmp_error">
        <slice>
            <filter src_ip="160.49.29.78"/>
        </slice>
        <from usec="0" sec="1223614801"/>
        <to usec="0" sec="1223615269"/>
    </anomaly>
    <anomaly type="suspicious" value="1.573730,1.670720,503,1 0 1 1 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="136.228.46.169" dst_ip="213.55.226.63" dst_port="80"/>
            <filter src_ip="136.228.46.169" dst_ip="195.174.154.34" dst_port="80"/>
        </slice>
        <from usec="0" sec="1223614852"/>
        <to usec="0" sec="1223615347"/>
    </anomaly>
    <anomaly type="suspicious" value="0.792191,1.143860,503,1 0 0 1 0 0 0 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="162.73.46.178" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.850920,1.209490,999,0 0 0 1 1 0 0 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="142.243.51.129" src_port="53"/>
            <filter dst_ip="142.243.51.129" dst_port="53"/>
        </slice>
        <from usec="0" sec="1223614801"/>
        <to usec="0" sec="1223615629"/>
    </anomaly>
    <anomaly type="suspicious" value="1.077310,1.178810,999,1 0 0 1 1 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="72.211.169.172" dst_ip="136.228.81.35"/>
            <filter src_ip="72.211.169.172" dst_ip="136.228.81.90"/>
            <filter src_ip="72.211.169.172" src_port="554"/>
            <filter src_ip="72.211.169.172" src_port="5004"/>
            <filter dst_ip="136.228.81.35" src_port="554"/>
            <filter dst_ip="136.228.81.90" src_port="554"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.221810,1.232200,999,1 1 0 1 1 0 0 0 0 1 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="162.73.189.209" src_port="6563"/>
            <filter src_ip="162.73.189.209" dst_port="80"/>
            <filter src_port="6563" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.865654,1.188600,503,1 0 0 1 1 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="20.184.164.166" dst_ip="212.21.136.204" dst_port="80"/>
            <filter src_ip="194.197.138.92" dst_ip="212.21.136.204" dst_port="80"/>
        </slice>
        <from usec="0" sec="1223614804"/>
        <to usec="0" sec="1223615629"/>
    </anomaly>
    <anomaly type="suspicious" value="0.850920,1.209490,999,0 0 0 1 1 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="136.228.122.37" src_port="25"/>
            <filter dst_ip="99.105.144.1" dst_port="25"/>
        </slice>
        <from usec="0" sec="1223614805"/>
        <to usec="0" sec="1223615629"/>
    </anomaly>
    <anomaly type="suspicious" value="0.850920,1.209490,999,0 0 0 1 1 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="162.73.128.139" src_port="20798"/>
        </slice>
        <from usec="0" sec="1223614801"/>
        <to usec="0" sec="1223615629"/>
    </anomaly>
    <anomaly type="suspicious" value="0.850920,1.209490,503,0 0 0 1 1 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="136.228.72.103" dst_ip="219.147.39.240" src_port="1079" dst_port="80"/>
        </slice>
        <from usec="0" sec="1223614801"/>
        <to usec="0" sec="1223614909"/>
    </anomaly>
    <anomaly type="suspicious" value="0.850920,1.209490,020,0 0 0 1 1 0 0 0 0 0 0 0,ntscICecrqICecrprp">
        <slice>
            <filter dst_ip="212.21.132.78" src_port="53"/>
            <filter dst_ip="212.21.132.78"/>
        </slice>
        <from usec="0" sec="1223614801"/>
        <to usec="0" sec="1223614909"/>
    </anomaly>
    <anomaly type="suspicious" value="0.850920,1.209490,504,0 0 0 1 1 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="136.228.64.25" dst_port="8612"/>
            <filter src_ip="136.228.64.25" dst_port="443"/>
        </slice>
        <from usec="0" sec="1223614801"/>
        <to usec="0" sec="1223614909"/>
    </anomaly>
    <anomaly type="suspicious" value="0.850920,1.209490,999,0 0 0 1 1 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="107.4.66.134" src_port="5050"/>
        </slice>
        <from usec="0" sec="1223614802"/>
        <to usec="0" sec="1223614909"/>
    </anomaly>
    <anomaly type="suspicious" value="0.850920,1.209490,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="136.228.81.72" dst_ip="192.95.51.102" dst_port="80"/>
        </slice>
        <from usec="0" sec="1223614809"/>
        <to usec="0" sec="1223614816"/>
    </anomaly>
    <anomaly type="suspicious" value="0.850920,1.209490,503,0 0 0 1 1 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="142.243.188.161" dst_ip="106.229.199.160" dst_port="80"/>
            <filter src_ip="142.243.188.161" dst_ip="211.54.133.123" dst_port="80"/>
        </slice>
        <from usec="0" sec="1223614813"/>
        <to usec="0" sec="1223614870"/>
    </anomaly>
    <anomaly type="suspicious" value="0.850920,1.209490,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="195.173.76.46" dst_ip="136.228.122.144" src_port="80"/>
        </slice>
        <from usec="0" sec="1223614895"/>
        <to usec="0" sec="1223614903"/>
    </anomaly>
    <anomaly type="suspicious" value="0.850920,1.209490,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="136.228.81.218" dst_ip="221.18.85.52" src_port="3759" dst_port="80"/>
        </slice>
        <from usec="0" sec="1223614899"/>
        <to usec="0" sec="1223614902"/>
    </anomaly>
    <anomaly type="suspicious" value="0.850920,1.209490,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="136.228.65.70" dst_ip="207.156.26.33" src_port="80" dst_port="1046"/>
        </slice>
        <from usec="0" sec="1223614801"/>
        <to usec="0" sec="1223614821"/>
    </anomaly>
    <anomaly type="suspicious" value="0.850920,1.209490,503,0 0 0 1 1 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="212.21.134.143" dst_ip="107.100.242.10" src_port="80" dst_port="46301"/>
            <filter src_ip="212.21.134.143" dst_ip="107.100.242.10" src_port="80" dst_port="34698"/>
            <filter src_ip="153.109.3.14" dst_ip="107.100.242.10" src_port="80" dst_port="52547"/>
        </slice>
        <from usec="0" sec="1223614804"/>
        <to usec="0" sec="1223614996"/>
    </anomaly>
    <anomaly type="suspicious" value="0.850920,1.209490,503,0 0 0 1 1 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="162.73.95.13" dst_ip="192.217.214.155" dst_port="80"/>
        </slice>
        <from usec="0" sec="1223614947"/>
        <to usec="0" sec="1223614996"/>
    </anomaly>
    <anomaly type="suspicious" value="1.065510,1.199880,501,0 0 0 1 1 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter src_ip="77.243.131.37" dst_ip="212.21.128.71" dst_port="21"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.850920,1.209490,504,0 0 0 1 1 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="142.243.240.93" dst_ip="23.9.24.237" dst_port="443"/>
            <filter src_ip="162.73.128.148" dst_ip="23.9.24.237" dst_port="443"/>
        </slice>
        <from usec="0" sec="1223614807"/>
        <to usec="0" sec="1223615055"/>
    </anomaly>
    <anomaly type="suspicious" value="0.850920,1.209490,503,0 0 0 1 1 0 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="194.8.20.116" dst_ip="136.228.155.7" src_port="80"/>
        </slice>
        <from usec="0" sec="1223614801"/>
        <to usec="0" sec="1223615179"/>
    </anomaly>
    <anomaly type="suspicious" value="0.850920,1.209490,999,0 0 0 1 1 0 0 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="162.73.128.139" dst_port="20798"/>
        </slice>
        <from usec="0" sec="1223614801"/>
        <to usec="0" sec="1223615359"/>
    </anomaly>
    <anomaly type="suspicious" value="0.850920,1.209490,999,0 0 0 1 1 0 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="107.4.66.90" dst_ip="164.25.84.115" src_port="5050"/>
        </slice>
        <from usec="0" sec="1223614801"/>
        <to usec="0" sec="1223615177"/>
    </anomaly>
    <anomaly type="suspicious" value="0.850920,1.209490,999,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="136.228.14.9" dst_ip="96.6.43.89" src_port="2864" dst_port="6667"/>
        </slice>
        <from usec="0" sec="1223614804"/>
        <to usec="0" sec="1223615449"/>
    </anomaly>
    <anomaly type="suspicious" value="0.850920,1.209490,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="136.228.94.209" dst_ip="76.10.28.77" dst_port="80"/>
        </slice>
        <from usec="0" sec="1223614916"/>
        <to usec="0" sec="1223615172"/>
    </anomaly>
    <anomaly type="suspicious" value="0.850920,1.209490,999,0 0 0 1 1 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="142.243.65.193" dst_ip="212.20.14.182"/>
        </slice>
        <from usec="0" sec="1223614801"/>
        <to usec="0" sec="1223615269"/>
    </anomaly>
    <anomaly type="suspicious" value="0.850920,1.209490,010,0 0 0 1 1 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="18.191.81.254" src_port="80"/>
        </slice>
        <from usec="0" sec="1223614805"/>
        <to usec="0" sec="1223615269"/>
    </anomaly>
    <anomaly type="suspicious" value="0.850920,1.209490,503,0 0 0 1 1 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="126.63.18.53" dst_ip="164.25.98.18" dst_port="80"/>
            <filter src_ip="126.63.18.53" dst_ip="164.25.74.67" dst_port="80"/>
        </slice>
        <from usec="0" sec="1223614897"/>
        <to usec="0" sec="1223615130"/>
    </anomaly>
    <anomaly type="suspicious" value="0.850920,1.209490,503,0 0 0 1 1 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="212.138.109.105" dst_ip="213.33.62.158" src_port="80" dst_port="54075"/>
        </slice>
        <from usec="0" sec="1223615244"/>
        <to usec="0" sec="1223615269"/>
    </anomaly>
    <anomaly type="suspicious" value="0.850920,1.209490,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="193.139.21.10" dst_ip="136.228.8.96" src_port="80"/>
        </slice>
        <from usec="0" sec="1223615176"/>
        <to usec="0" sec="1223615322"/>
    </anomaly>
    <anomaly type="suspicious" value="0.850920,1.209490,503,0 0 0 1 1 0 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="212.21.128.162" dst_ip="114.167.198.225" dst_port="80"/>
        </slice>
        <from usec="0" sec="1223614801"/>
        <to usec="0" sec="1223615609"/>
    </anomaly>
    <anomaly type="suspicious" value="0.850920,1.209490,503,0 0 0 1 1 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="142.243.11.192" dst_port="3478"/>
            <filter src_ip="142.243.11.192" dst_ip="50.80.27.249" dst_port="80"/>
        </slice>
        <from usec="0" sec="1223614803"/>
        <to usec="0" sec="1223615530"/>
    </anomaly>
    <anomaly type="suspicious" value="0.850920,1.209490,503,0 0 0 1 1 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="136.228.67.129" dst_ip="167.176.91.174" dst_port="80"/>
        </slice>
        <from usec="0" sec="1223615278"/>
        <to usec="0" sec="1223615516"/>
    </anomaly>
    <anomaly type="suspicious" value="0.850920,1.209490,999,0 0 0 1 1 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="0.252.29.70" dst_ip="164.25.93.3" dst_port="25"/>
            <filter src_ip="101.176.3.132" dst_ip="164.25.93.3" dst_port="25"/>
        </slice>
        <from usec="0" sec="1223614801"/>
        <to usec="0" sec="1223615512"/>
    </anomaly>
    <anomaly type="suspicious" value="0.850920,1.209490,020,0 0 0 1 1 0 0 0 0 0 0 0,icmp_error">
        <slice>
            <filter src_ip="136.228.244.100"/>
        </slice>
        <from usec="0" sec="1223614801"/>
        <to usec="0" sec="1223615616"/>
    </anomaly>
    <anomaly type="suspicious" value="0.850920,1.209490,503,0 0 0 1 1 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="213.43.162.165" dst_ip="162.73.64.62" src_port="80"/>
            <filter src_ip="212.138.109.28" dst_ip="162.73.64.62" src_port="80"/>
            <filter src_ip="212.138.109.139" dst_ip="162.73.64.62" src_port="80"/>
        </slice>
        <from usec="0" sec="1223615044"/>
        <to usec="0" sec="1223615554"/>
    </anomaly>
    <anomaly type="suspicious" value="0.850920,1.209490,503,0 0 0 1 1 0 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="73.42.151.89" dst_ip="162.73.25.151" src_port="80"/>
        </slice>
        <from usec="0" sec="1223615146"/>
        <to usec="0" sec="1223615612"/>
    </anomaly>
    <anomaly type="suspicious" value="0.850920,1.209490,503,0 0 0 1 1 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="142.243.151.3" dst_ip="204.105.128.198" src_port="80"/>
        </slice>
        <from usec="0" sec="1223615156"/>
        <to usec="0" sec="1223615613"/>
    </anomaly>
    <anomaly type="suspicious" value="0.850920,1.209490,503,0 0 0 1 1 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="136.228.104.133" dst_ip="72.6.122.13" src_port="4643" dst_port="80"/>
        </slice>
        <from usec="0" sec="1223615246"/>
        <to usec="0" sec="1223615531"/>
    </anomaly>
    <anomaly type="suspicious" value="0.850920,1.209490,503,0 0 0 1 1 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="73.120.139.2" dst_ip="142.243.12.78" src_port="80"/>
            <filter src_ip="73.120.139.2" dst_ip="142.243.10.250" src_port="80"/>
        </slice>
        <from usec="0" sec="1223615425"/>
        <to usec="0" sec="1223615612"/>
    </anomaly>
    <anomaly type="suspicious" value="1.245950,1.327670,999,0 0 0 1 1 0 1 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="142.243.51.238" dst_ip="96.30.195.135"/>
            <filter src_ip="142.243.51.238" dst_port="53"/>
            <filter src_ip="142.243.51.236" dst_port="53"/>
            <filter dst_ip="96.30.195.135" dst_port="53"/>
        </slice>
        <from usec="0" sec="1223614801"/>
        <to usec="0" sec="1223615629"/>
    </anomaly>
    <anomaly type="suspicious" value="1.030040,1.341210,020,0 0 0 0 0 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="107.79.64.14"/>
        </slice>
        <from usec="0" sec="1223614801"/>
        <to usec="0" sec="1223614847"/>
    </anomaly>
    <anomaly type="suspicious" value="0.850920,1.209490,999,0 0 0 1 1 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="21.96.154.145" dst_port="53"/>
        </slice>
        <from usec="0" sec="1223614807"/>
        <to usec="0" sec="1223615359"/>
    </anomaly>
    <anomaly type="suspicious" value="1.173400,1.326690,999,1 1 0 1 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="213.42.134.106" dst_port="53"/>
        </slice>
        <from usec="0" sec="1223614801"/>
        <to usec="0" sec="1223615439"/>
    </anomaly>
    <anomaly type="suspicious" value="1.030040,1.341210,999,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="164.25.87.143"/>
        </slice>
        <from usec="0" sec="1223614801"/>
        <to usec="0" sec="1223614847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.030040,1.341210,999,0 0 0 0 0 0 1 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="164.25.23.168"/>
        </slice>
        <from usec="0" sec="1223614801"/>
        <to usec="0" sec="1223614847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.042250,1.322390,999,1 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="142.243.167.56" dst_port="53"/>
        </slice>
        <from usec="0" sec="1223614801"/>
        <to usec="0" sec="1223615340"/>
    </anomaly>
    <anomaly type="suspicious" value="1.030040,1.341210,999,0 0 0 0 0 0 1 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="142.243.51.129" dst_ip="194.169.21.168" dst_port="53"/>
            <filter src_ip="136.228.246.227" dst_ip="194.169.21.168" dst_port="53"/>
        </slice>
        <from usec="0" sec="1223614801"/>
        <to usec="0" sec="1223614847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.030040,1.341210,999,0 0 0 0 0 0 1 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="162.73.17.67" dst_ip="107.43.44.218"/>
        </slice>
        <from usec="0" sec="1223614801"/>
        <to usec="0" sec="1223614847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.042250,1.322390,999,1 0 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="213.33.140.245" src_port="7596"/>
        </slice>
        <from usec="0" sec="1223614801"/>
        <to usec="0" sec="1223614923"/>
    </anomaly>
    <anomaly type="suspicious" value="1.245950,1.327670,999,0 0 0 1 1 0 1 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="139.179.92.31" src_port="53"/>
            <filter dst_ip="142.243.51.129" src_port="53"/>
        </slice>
        <from usec="0" sec="1223614801"/>
        <to usec="0" sec="1223615268"/>
    </anomaly>
    <anomaly type="suspicious" value="1.030040,1.341210,011,0 0 0 0 0 0 1 0 0 0 0 0,point_to_point">
        <slice>
            <filter dst_ip="142.47.49.197" src_port="10137"/>
        </slice>
        <from usec="0" sec="1223614801"/>
        <to usec="0" sec="1223614847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.030040,1.341210,020,0 0 0 0 0 0 1 0 0 0 0 0,icmp_error">
        <slice>
            <filter dst_ip="160.49.29.78"/>
        </slice>
        <from usec="0" sec="1223615116"/>
        <to usec="0" sec="1223615162"/>
    </anomaly>
    <anomaly type="suspicious" value="1.030040,1.341210,502,0 0 0 0 0 0 1 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="107.113.136.187"/>
        </slice>
        <from usec="0" sec="1223615116"/>
        <to usec="0" sec="1223615162"/>
    </anomaly>
    <anomaly type="suspicious" value="1.030040,1.341210,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="160.49.228.224" dst_port="15160"/>
        </slice>
        <from usec="0" sec="1223614981"/>
        <to usec="0" sec="1223615207"/>
    </anomaly>
    <anomaly type="suspicious" value="1.030040,1.341210,999,0 0 0 0 0 0 1 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="192.89.135.5" dst_ip="164.25.66.214"/>
        </slice>
        <from usec="0" sec="1223615116"/>
        <to usec="0" sec="1223615162"/>
    </anomaly>
    <anomaly type="suspicious" value="1.030040,1.341210,999,0 0 0 0 0 0 1 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="192.89.135.0" dst_ip="164.25.66.214"/>
        </slice>
        <from usec="0" sec="1223615116"/>
        <to usec="0" sec="1223615162"/>
    </anomaly>
    <anomaly type="suspicious" value="1.009640,1.296730,999,0 0 0 1 0 0 1 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="136.228.44.214" src_port="62191"/>
        </slice>
        <from usec="0" sec="1223614811"/>
        <to usec="0" sec="1223615509"/>
    </anomaly>
    <anomaly type="suspicious" value="1.245950,1.327670,999,0 0 0 1 1 0 1 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="136.228.82.164" dst_port="53"/>
            <filter dst_ip="108.144.184.219" dst_port="53"/>
        </slice>
        <from usec="0" sec="1223614802"/>
        <to usec="0" sec="1223615447"/>
    </anomaly>
    <anomaly type="suspicious" value="1.030040,1.341210,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="213.42.134.20" dst_port="53"/>
        </slice>
        <from usec="0" sec="1223615161"/>
        <to usec="0" sec="1223615207"/>
    </anomaly>
    <anomaly type="suspicious" value="1.030040,1.341210,010,0 0 0 0 0 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="136.228.35.49" dst_port="25"/>
        </slice>
        <from usec="0" sec="1223615161"/>
        <to usec="0" sec="1223615207"/>
    </anomaly>
    <anomaly type="suspicious" value="1.030040,1.341210,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="142.243.74.142" src_port="16358"/>
        </slice>
        <from usec="0" sec="1223615161"/>
        <to usec="0" sec="1223615207"/>
    </anomaly>
    <anomaly type="suspicious" value="1.022090,1.277260,999,1 0 0 1 0 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="213.195.38.243" src_port="53"/>
        </slice>
        <from usec="0" sec="1223614804"/>
        <to usec="0" sec="1223615672"/>
    </anomaly>
    <anomaly type="suspicious" value="1.030040,1.341210,503,0 0 0 0 0 0 1 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="21.221.107.243" src_port="80"/>
        </slice>
        <from usec="0" sec="1223615161"/>
        <to usec="0" sec="1223615207"/>
    </anomaly>
    <anomaly type="suspicious" value="1.030040,1.341210,503,0 0 0 0 0 0 1 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="195.162.157.65" dst_ip="136.228.64.48" src_port="80"/>
        </slice>
        <from usec="0" sec="1223615116"/>
        <to usec="0" sec="1223615207"/>
    </anomaly>
    <anomaly type="suspicious" value="1.191000,1.370200,010,1 1 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="102.195.244.40" dst_port="135"/>
        </slice>
        <from usec="0" sec="1223614976"/>
        <to usec="0" sec="1223615451"/>
    </anomaly>
    <anomaly type="suspicious" value="1.148150,1.241830,999,1 0 0 0 0 0 0 0 0 1 1 0,mptpla">
        <slice>
            <filter src_ip="212.24.87.108" dst_ip="160.49.140.36" src_port="443"/>
            <filter src_ip="71.170.226.255" dst_ip="160.49.140.36" src_port="5900"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.196080,1.287770,999,0 0 0 1 0 0 1 0 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="136.228.237.233"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.000700,1.246770,504,1 1 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter src_ip="136.228.81.60" dst_ip="213.43.77.69" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.000700,1.246770,503,1 1 0 0 0 0 0 0 0 1 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="136.228.109.74" dst_port="443"/>
            <filter src_ip="136.228.109.74" dst_ip="194.19.50.201" dst_port="80"/>
            <filter src_ip="136.228.109.74" dst_ip="221.18.80.131" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.818037,1.194040,503,1 0 0 0 0 0 0 0 0 1 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="136.228.202.188" src_port="53"/>
            <filter src_ip="136.228.202.188" dst_port="80"/>
            <filter src_ip="136.228.202.188" src_port="32768" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.850920,1.209490,503,0 0 0 1 1 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="136.228.138.11" dst_ip="114.71.218.151" src_port="3801" dst_port="80"/>
        </slice>
        <from usec="0" sec="1223614801"/>
        <to usec="0" sec="1223614827"/>
    </anomaly>
    <anomaly type="suspicious" value="1.148150,1.241830,503,1 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="150.133.45.219" dst_ip="72.136.147.125" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.675960,1.708800,503,1 1 1 1 0 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="213.33.128.10" dst_port="80"/>
            <filter dst_ip="212.138.109.31" dst_port="80"/>
        </slice>
        <from usec="0" sec="1223614801"/>
        <to usec="0" sec="1223615665"/>
    </anomaly>
    <anomaly type="suspicious" value="0.979681,1.198800,503,1 1 0 1 0 0 0 0 0 1 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="212.21.136.200" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.818037,1.194040,503,1 0 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="212.21.136.142" dst_ip="128.9.1.188" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.137080,1.261850,503,0 0 0 0 0 0 0 0 0 1 1 0,ptmplaHTTP">
        <slice>
            <filter src_ip="212.138.109.114" dst_ip="136.228.214.244" src_port="80"/>
            <filter src_ip="212.138.109.114" dst_ip="142.243.10.78" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.865654,1.188600,503,1 0 0 1 1 0 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="200.201.5.56" dst_ip="136.228.85.93" src_port="80"/>
        </slice>
        <from usec="0" sec="1223614852"/>
        <to usec="0" sec="1223615676"/>
    </anomaly>
    <anomaly type="suspicious" value="1.137080,1.261850,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="142.243.51.209" dst_ip="99.29.207.27" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.118630,1.214470,503,0 0 0 1 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="136.228.122.66" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.118630,1.214470,503,0 0 0 1 0 0 0 0 0 1 1 0,salphfl">
        <slice>
            <filter src_ip="195.160.216.98" dst_ip="136.228.119.64" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.118630,1.214470,503,0 0 0 1 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="142.228.95.23" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.792191,1.143860,999,1 0 0 1 0 0 0 0 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="162.73.189.236" dst_port="1889"/>
            <filter dst_ip="162.73.189.236" dst_port="8512"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.000700,1.246770,503,1 1 0 0 0 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="136.228.172.54" dst_port="80"/>
            <filter dst_ip="210.67.0.252" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.000700,1.246770,999,1 1 0 0 0 0 0 0 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="212.21.129.56" dst_port="53"/>
            <filter src_ip="212.21.129.56" dst_ip="107.100.224.149" dst_port="25"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.000700,1.246770,503,1 1 0 0 0 0 0 0 0 1 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="136.228.138.13" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.137080,1.261850,503,0 0 0 0 0 0 0 0 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="142.16.165.103" src_port="80"/>
            <filter src_ip="142.16.165.103" src_port="123" dst_port="123"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.137080,1.261850,999,0 0 0 0 0 0 0 0 0 1 1 0,ptmpla">
        <slice>
            <filter src_ip="213.33.130.212"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.137080,1.261850,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="212.138.109.130" dst_ip="142.243.15.26" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.137080,1.261850,999,0 0 0 0 0 0 0 0 0 1 1 0,ptmpla">
        <slice>
            <filter src_ip="142.243.51.128" dst_ip="72.215.13.110" src_port="995"/>
            <filter src_ip="142.243.51.128" dst_ip="72.71.39.114" src_port="995"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.137080,1.261850,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="212.138.109.112" dst_ip="136.228.154.0" src_port="80" dst_port="3664"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.118630,1.214470,503,0 0 0 1 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="136.228.71.181" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.137080,1.261850,503,0 0 0 0 0 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter src_ip="194.173.173.185" dst_ip="136.228.104.160" src_port="80"/>
            <filter src_ip="216.111.68.211" dst_ip="136.228.104.160" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.118630,1.214470,503,0 0 0 1 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="136.228.172.211" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.129880,1.193660,503,1 0 0 1 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="142.228.95.20" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.850920,1.209490,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="108.129.218.54" dst_ip="142.228.95.17" src_port="80"/>
        </slice>
        <from usec="0" sec="1223614814"/>
        <to usec="0" sec="1223615579"/>
    </anomaly>
    <anomaly type="suspicious" value="1.065510,1.199880,503,0 0 0 1 1 0 0 0 0 1 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="212.138.109.144" dst_ip="136.228.94.176" src_port="80"/>
            <filter src_ip="212.138.109.144" dst_ip="162.73.197.84" src_port="80"/>
            <filter src_ip="212.138.109.144" dst_ip="136.228.118.197" src_port="80"/>
            <filter src_ip="212.138.109.144" dst_ip="162.73.194.106" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.137080,1.261850,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="210.192.150.156" dst_ip="162.73.66.35" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.118630,1.214470,503,0 0 0 1 0 0 0 0 0 1 1 0,salphfl">
        <slice>
            <filter src_ip="212.138.109.92" dst_ip="162.73.87.157" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.009640,1.296730,002,0 0 0 1 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="107.79.64.14" src_port="139"/>
            <filter dst_ip="107.79.64.14"/>
        </slice>
        <from usec="0" sec="1223614801"/>
        <to usec="0" sec="1223615179"/>
    </anomaly>
    <anomaly type="suspicious" value="1.118630,1.214470,503,0 0 0 1 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="210.192.150.159" dst_ip="213.33.144.180" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
