<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="anomalous" value="4.096300,3.107180,010,1 1 1 1 1 1 1 1 1 1 1 1,ntscSYNt139445">
        <slice>
            <filter src_ip="205.136.141.225" src_port="6000" dst_port="445"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.057600,2.541230,503,1 1 1 1 1 0 0 0 0 1 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="209.149.177.142" dst_port="139"/>
            <filter src_ip="209.149.177.142" dst_ip="214.106.7.212" dst_port="80"/>
            <filter src_ip="209.149.177.142" dst_ip="54.198.142.80" dst_port="80"/>
            <filter src_ip="209.149.177.142" dst_ip="54.139.9.120" dst_port="993"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.748750,1.669400,010,1 1 0 0 0 0 1 1 1 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="196.0.8.41" dst_port="139"/>
        </slice>
        <from usec="0" sec="1226379600"/>
        <to usec="0" sec="1226379803"/>
    </anomaly>
    <anomaly type="anomalous" value="2.157390,1.675380,503,1 1 0 1 1 0 1 1 1 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="76.218.5.231" dst_ip="209.149.180.150" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.950470,2.543690,999,1 1 1 1 1 0 0 0 0 0 0 0,ipv4gretun">
        <slice>
            <filter src_ip="208.89.102.50" dst_ip="208.27.101.71"/>
            <filter src_ip="208.89.102.50" dst_ip="10.1.2.32"/>
            <filter src_ip="208.89.102.50" dst_ip="10.0.2.2"/>
            <filter src_ip="209.162.149.71" dst_ip="208.27.101.71"/>
        </slice>
        <from usec="0" sec="1226379600"/>
        <to usec="0" sec="1226380428"/>
    </anomaly>
    <anomaly type="anomalous" value="4.096300,3.107180,010,1 1 1 1 1 1 1 1 1 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="76.174.227.240" src_port="6000" dst_port="1433"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.784370,2.537300,010,1 1 1 0 0 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="73.100.76.61" src_port="6000" dst_port="135"/>
        </slice>
        <from usec="0" sec="1226379684"/>
        <to usec="0" sec="1226379686"/>
    </anomaly>
    <anomaly type="anomalous" value="1.748750,1.669400,010,1 1 0 0 0 0 1 1 1 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="204.98.195.132" dst_port="445"/>
            <filter src_ip="204.98.195.132" dst_port="139"/>
        </slice>
        <from usec="0" sec="1226380239"/>
        <to usec="0" sec="1226380321"/>
    </anomaly>
    <anomaly type="anomalous" value="2.082200,1.721310,503,1 0 0 1 1 1 0 0 0 1 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="214.106.7.212" dst_ip="209.149.177.142" src_port="80"/>
            <filter src_ip="54.198.142.80" dst_ip="209.149.177.142" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.921430,1.724920,999,1 0 0 1 1 1 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="157.80.141.182" src_port="17774"/>
            <filter src_ip="157.80.141.182" src_port="17772"/>
            <filter src_ip="157.80.141.182" dst_port="1024"/>
            <filter src_port="17774" dst_port="1024"/>
            <filter src_port="17772" dst_port="1024"/>
        </slice>
        <from usec="0" sec="1226379600"/>
        <to usec="0" sec="1226380428"/>
    </anomaly>
    <anomaly type="anomalous" value="2.291920,1.803410,503,0 0 0 1 1 1 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="152.161.160.30" dst_ip="98.150.172.114" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.774660,1.451910,503,1 0 0 1 1 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter src_ip="5.34.130.115" dst_ip="157.80.210.194" src_port="80"/>
            <filter src_ip="5.34.130.114" dst_ip="157.80.210.194" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.031320,1.722150,503,0 0 0 1 1 1 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="208.130.80.10" dst_ip="157.80.82.92" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.291920,1.803410,503,0 0 0 1 1 1 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter src_ip="115.23.69.66" dst_ip="165.68.27.105" src_port="80" dst_port="54361"/>
            <filter src_ip="7.21.209.166" dst_ip="165.68.27.105" src_port="80" dst_port="54295"/>
            <filter src_ip="222.148.151.158" dst_ip="165.68.27.105" src_port="80" dst_port="54360"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.866170,1.725770,503,0 0 0 1 1 1 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="152.161.84.49" dst_ip="71.49.160.113" src_port="62456" dst_port="80"/>
            <filter src_ip="152.161.84.49" dst_ip="209.20.102.133" src_port="63085" dst_port="80"/>
        </slice>
        <from usec="0" sec="1226380044"/>
        <to usec="0" sec="1226380060"/>
    </anomaly>
    <anomaly type="anomalous" value="2.337140,1.802610,503,1 0 0 1 1 1 0 0 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="157.80.10.168" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.074660,2.240140,503,1 0 0 1 1 1 1 1 1 1 1 1,mptmp">
        <slice>
            <filter src_ip="209.149.185.55" src_port="80"/>
            <filter src_ip="209.149.185.54" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.031320,1.722150,503,0 0 0 1 1 1 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="152.185.53.14" dst_ip="208.249.65.205" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.526400,1.406490,503,1 0 0 1 1 0 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="208.23.49.142" dst_port="80"/>
        </slice>
        <from usec="0" sec="1226379600"/>
        <to usec="0" sec="1226380428"/>
    </anomaly>
    <anomaly type="anomalous" value="1.774660,1.451910,503,1 0 0 1 1 0 0 0 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="165.68.195.76" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.879830,2.208380,503,0 0 0 1 1 1 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="152.164.134.67" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.915940,2.207720,503,1 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="157.80.148.150" dst_port="80"/>
            <filter src_ip="157.80.148.175" dst_port="80"/>
            <filter src_ip="157.80.148.98" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.275520,2.597050,503,1 1 1 1 1 0 1 0 0 1 1 0,mptmp">
        <slice>
            <filter dst_ip="209.149.185.55" dst_port="80"/>
            <filter dst_ip="209.149.185.54" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.889300,2.549050,010,1 1 1 0 0 0 1 1 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="200.203.21.95" dst_port="445"/>
            <filter src_ip="200.203.21.95" dst_port="139"/>
        </slice>
        <from usec="0" sec="1226379600"/>
        <to usec="0" sec="1226379676"/>
    </anomaly>
    <anomaly type="anomalous" value="1.906510,1.635450,999,1 1 0 1 0 0 1 1 1 1 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="221.231.106.82" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.662610,1.403090,503,0 0 0 1 1 0 1 1 1 1 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="157.80.94.152" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.105560,1.767050,999,0 0 0 1 1 1 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="157.80.55.224" dst_port="53"/>
            <filter src_ip="157.80.226.85" src_port="59173" dst_port="53"/>
        </slice>
        <from usec="0" sec="1226379600"/>
        <to usec="0" sec="1226380321"/>
    </anomaly>
    <anomaly type="anomalous" value="1.526400,1.406490,999,1 0 0 1 1 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter dst_port="3127"/>
            <filter dst_ip="209.149.189.33" dst_port="3128"/>
            <filter dst_ip="209.149.189.33" dst_port="3124"/>
            <filter dst_ip="209.149.189.42" dst_port="3124"/>
            <filter dst_ip="209.149.189.32" dst_port="3128"/>
        </slice>
        <from usec="0" sec="1226379601"/>
        <to usec="0" sec="1226380424"/>
    </anomaly>
    <anomaly type="anomalous" value="1.906510,1.635450,999,1 1 0 1 0 0 1 1 1 1 0 0,ntscUDP">
        <slice>
            <filter src_ip="221.231.106.82" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.748750,1.669400,504,1 1 0 0 0 0 1 1 1 0 0 0,mptpla">
        <slice>
            <filter src_ip="157.80.159.36" dst_ip="208.26.1.234" dst_port="443"/>
            <filter src_ip="157.80.146.198" dst_ip="208.26.1.234" dst_port="443"/>
        </slice>
        <from usec="0" sec="1226380275"/>
        <to usec="0" sec="1226380321"/>
    </anomaly>
    <anomaly type="anomalous" value="2.291920,1.803410,503,0 0 0 1 1 1 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="208.23.49.142" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.724410,1.402050,503,1 0 0 1 1 0 1 1 1 1 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="152.185.104.156" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.694500,1.457040,999,0 0 0 1 0 0 1 1 1 1 1 0,ptmp">
        <slice>
            <filter src_ip="152.185.53.69" src_port="25"/>
            <filter src_ip="152.185.53.69" dst_port="25"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.157390,1.675380,011,1 1 0 1 1 0 1 1 1 1 0 0,DDoSRSTrp">
        <slice>
            <filter src_ip="209.149.189.33" src_port="3128"/>
            <filter src_ip="209.149.189.33" src_port="3124"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.879830,2.208380,503,0 0 0 1 1 1 0 0 0 1 1 1,ptmplaHTTP">
        <slice>
            <filter src_ip="152.185.179.2" dst_ip="98.150.161.118" src_port="80"/>
            <filter src_ip="152.185.179.2" dst_ip="104.43.69.99" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.242340,1.924360,503,0 0 0 0 0 0 0 0 0 1 1 1,malphfl">
        <slice>
            <filter src_ip="202.71.157.87" dst_ip="157.80.71.150" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.242340,1.924360,503,0 0 0 0 0 0 0 0 0 1 1 1,ptmplaHTTP">
        <slice>
            <filter src_ip="152.185.18.188" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.672210,1.968980,503,1 0 0 1 1 0 1 1 1 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="208.27.101.27" dst_port="80"/>
            <filter src_ip="208.27.101.27" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.459400,1.405650,503,1 0 0 1 0 0 0 0 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="209.149.190.191" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.879830,2.208380,503,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="215.147.110.124" src_port="80"/>
            <filter dst_ip="152.164.134.65" src_port="80"/>
            <filter dst_ip="152.164.134.64" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.227340,1.898260,503,0 0 0 1 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="152.164.134.68" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.714670,1.452910,503,0 0 0 1 1 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="165.68.241.121" src_port="80"/>
            <filter dst_ip="221.46.45.36" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.672210,1.968980,503,1 0 0 1 1 0 1 1 1 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="157.80.179.203" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.328910,1.897580,503,1 0 0 1 0 0 1 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="208.27.101.27" src_port="80"/>
            <filter dst_ip="208.27.101.27" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.451670,1.625640,504,1 1 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="157.80.154.211" dst_ip="115.68.145.30" src_port="60488" dst_port="35405"/>
            <filter src_ip="157.80.154.211" dst_ip="54.136.49.119" src_port="45059" dst_port="123"/>
            <filter src_ip="157.80.154.211" dst_ip="98.128.95.77" src_port="47736" dst_port="80"/>
            <filter src_ip="157.80.154.211" dst_ip="200.164.4.98" src_port="62882" dst_port="443"/>
        </slice>
        <from usec="0" sec="1226379652"/>
        <to usec="0" sec="1226379655"/>
    </anomaly>
    <anomaly type="suspicious" value="1.451670,1.625640,999,1 1 0 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="157.80.46.3" src_port="53"/>
            <filter src_ip="157.80.46.3" src_port="25"/>
        </slice>
        <from usec="0" sec="1226379608"/>
        <to usec="0" sec="1226380286"/>
    </anomaly>
    <anomaly type="suspicious" value="1.428400,1.594670,503,1 1 0 1 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="0.141.201.156" dst_ip="152.185.179.2" src_port="2308" dst_port="80"/>
        </slice>
        <from usec="0" sec="1226379623"/>
        <to usec="0" sec="1226379676"/>
    </anomaly>
    <anomaly type="suspicious" value="1.451670,1.625640,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="208.23.164.159" dst_ip="42.135.145.125" dst_port="80"/>
        </slice>
        <from usec="0" sec="1226379629"/>
        <to usec="0" sec="1226379790"/>
    </anomaly>
    <anomaly type="suspicious" value="1.451670,1.625640,504,1 1 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="157.80.234.20" dst_port="80"/>
            <filter src_ip="157.80.234.20" dst_ip="101.114.213.94" dst_port="443"/>
        </slice>
        <from usec="0" sec="1226379667"/>
        <to usec="0" sec="1226379673"/>
    </anomaly>
    <anomaly type="suspicious" value="1.451670,1.625640,002,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="109.45.75.146" src_port="1025" dst_port="137"/>
        </slice>
        <from usec="0" sec="1226380427"/>
        <to usec="0" sec="1226380438"/>
    </anomaly>
    <anomaly type="suspicious" value="1.451670,1.625640,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="76.148.72.33" dst_port="139"/>
        </slice>
        <from usec="0" sec="1226380354"/>
        <to usec="0" sec="1226380380"/>
    </anomaly>
    <anomaly type="suspicious" value="1.451670,1.625640,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDPICdurp">
        <slice>
            <filter dst_ip="125.113.88.60"/>
        </slice>
        <from usec="0" sec="1226380137"/>
        <to usec="0" sec="1226380150"/>
    </anomaly>
    <anomaly type="suspicious" value="1.001610,1.299750,999,1 0 0 1 0 0 0 0 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="152.185.134.169" src_port="55595"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.385840,1.406680,503,0 0 0 1 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="166.61.198.44" dst_ip="205.34.33.217" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.081580,1.355330,503,0 0 0 1 1 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="157.80.145.222" dst_ip="195.166.80.121" dst_port="80"/>
            <filter src_ip="157.80.145.223" dst_ip="195.166.80.121" dst_port="80"/>
        </slice>
        <from usec="0" sec="1226379600"/>
        <to usec="0" sec="1226380334"/>
    </anomaly>
    <anomaly type="suspicious" value="1.081580,1.355330,503,0 0 0 1 1 0 0 0 0 0 0 0,point_to_point">
        <slice>
            <filter src_ip="165.68.5.189" dst_ip="158.24.129.62" dst_port="80"/>
        </slice>
        <from usec="0" sec="1226379608"/>
        <to usec="0" sec="1226380043"/>
    </anomaly>
    <anomaly type="suspicious" value="1.174360,1.354260,999,1 0 0 1 1 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="1.120.245.4" dst_ip="152.185.38.152" src_port="600"/>
            <filter src_ip="1.120.245.4" dst_ip="152.185.38.152" src_port="8000"/>
            <filter src_ip="70.116.211.198" dst_ip="152.185.38.152" dst_port="1008"/>
        </slice>
        <from usec="0" sec="1226379600"/>
        <to usec="0" sec="1226380267"/>
    </anomaly>
    <anomaly type="suspicious" value="1.081580,1.355330,020,0 0 0 1 1 0 0 0 0 0 0 0,ntscUDPUDPICrp">
        <slice>
            <filter dst_ip="200.18.44.158"/>
        </slice>
        <from usec="0" sec="1226379600"/>
        <to usec="0" sec="1226380428"/>
    </anomaly>
    <anomaly type="suspicious" value="1.081580,1.355330,999,0 0 0 1 1 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="104.71.213.19" dst_port="995"/>
            <filter dst_ip="104.71.213.19" dst_port="993"/>
        </slice>
        <from usec="0" sec="1226379602"/>
        <to usec="0" sec="1226380243"/>
    </anomaly>
    <anomaly type="suspicious" value="1.081580,1.355330,999,0 0 0 1 1 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="208.23.164.146" src_port="10143"/>
        </slice>
        <from usec="0" sec="1226379613"/>
        <to usec="0" sec="1226380246"/>
    </anomaly>
    <anomaly type="suspicious" value="1.081580,1.355330,503,0 0 0 1 1 0 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="152.161.194.148" dst_ip="98.150.170.6" src_port="80"/>
        </slice>
        <from usec="0" sec="1226379603"/>
        <to usec="0" sec="1226380338"/>
    </anomaly>
    <anomaly type="suspicious" value="0.977201,1.327250,999,1 0 0 1 0 0 1 1 0 0 0 0,mptmp">
        <slice>
            <filter dst_ip="160.23.197.15" dst_port="25"/>
            <filter dst_ip="160.23.149.97" dst_port="25"/>
        </slice>
        <from usec="0" sec="1226379600"/>
        <to usec="0" sec="1226380366"/>
    </anomaly>
    <anomaly type="suspicious" value="1.049300,1.359750,999,0 0 0 1 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="157.80.50.93" dst_port="25"/>
        </slice>
        <from usec="0" sec="1226379600"/>
        <to usec="0" sec="1226380051"/>
    </anomaly>
    <anomaly type="suspicious" value="1.080760,1.395950,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="152.185.23.210" src_port="22340"/>
        </slice>
        <from usec="0" sec="1226379870"/>
        <to usec="0" sec="1226380051"/>
    </anomaly>
    <anomaly type="suspicious" value="1.144700,1.358680,999,1 0 0 1 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="152.185.193.34"/>
        </slice>
        <from usec="0" sec="1226379616"/>
        <to usec="0" sec="1226380342"/>
    </anomaly>
    <anomaly type="suspicious" value="1.049300,1.359750,002,0 0 0 1 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="120.133.4.96" src_port="1026" dst_port="137"/>
        </slice>
        <from usec="0" sec="1226380275"/>
        <to usec="0" sec="1226380321"/>
    </anomaly>
    <anomaly type="suspicious" value="1.080760,1.395950,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="221.245.2.120" src_port="6667"/>
        </slice>
        <from usec="0" sec="1226379600"/>
        <to usec="0" sec="1226380366"/>
    </anomaly>
    <anomaly type="suspicious" value="1.514530,1.594770,503,1 1 0 1 0 0 1 0 0 0 0 0,mptmp">
        <slice>
            <filter dst_port="80"/>
            <filter dst_ip="39.190.252.96" dst_port="8102"/>
        </slice>
        <from usec="0" sec="1226379600"/>
        <to usec="0" sec="1226380438"/>
    </anomaly>
    <anomaly type="suspicious" value="1.080760,1.395950,011,0 0 0 0 0 0 1 1 1 0 0 0,heavy_hitter">
        <slice>
            <filter src_ip="4.6.91.69" dst_ip="208.23.170.155" src_port="443"/>
        </slice>
        <from usec="0" sec="1226380275"/>
        <to usec="0" sec="1226380366"/>
    </anomaly>
    <anomaly type="suspicious" value="1.010910,1.364310,999,1 0 0 0 0 0 1 1 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="152.185.240.48" dst_port="25"/>
            <filter src_ip="152.185.240.48" src_port="32770" dst_port="53"/>
        </slice>
        <from usec="0" sec="1226379600"/>
        <to usec="0" sec="1226379646"/>
    </anomaly>
    <anomaly type="suspicious" value="1.080760,1.395950,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="157.80.9.229" src_port="32768" dst_port="53"/>
        </slice>
        <from usec="0" sec="1226379870"/>
        <to usec="0" sec="1226379916"/>
    </anomaly>
    <anomaly type="suspicious" value="1.080760,1.395950,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="221.245.2.124" src_port="6667"/>
        </slice>
        <from usec="0" sec="1226379870"/>
        <to usec="0" sec="1226380321"/>
    </anomaly>
    <anomaly type="suspicious" value="1.080760,1.395950,020,0 0 0 0 0 0 1 1 1 0 0 0,icmp_error">
        <slice>
            <filter src_ip="157.80.52.120"/>
        </slice>
        <from usec="0" sec="1226379870"/>
        <to usec="0" sec="1226379916"/>
    </anomaly>
    <anomaly type="suspicious" value="1.346000,1.391480,999,0 0 0 0 0 0 1 1 1 1 0 0,ntscUDP">
        <slice>
            <filter src_ip="157.80.101.17" src_port="61601"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.080760,1.395950,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="4.188.160.76" src_port="48585" dst_port="1026"/>
            <filter src_ip="4.188.160.76" src_port="48585" dst_port="1027"/>
        </slice>
        <from usec="0" sec="1226379870"/>
        <to usec="0" sec="1226379916"/>
    </anomaly>
    <anomaly type="suspicious" value="1.080760,1.395950,020,0 0 0 0 0 0 1 1 1 0 0 0,icmp_error">
        <slice>
            <filter src_ip="206.138.213.33"/>
        </slice>
        <from usec="0" sec="1226379600"/>
        <to usec="0" sec="1226380366"/>
    </anomaly>
    <anomaly type="suspicious" value="1.080760,1.395950,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="152.185.148.34" src_port="25"/>
            <filter src_ip="152.185.148.34" dst_port="53"/>
        </slice>
        <from usec="0" sec="1226379870"/>
        <to usec="0" sec="1226379916"/>
    </anomaly>
    <anomaly type="suspicious" value="1.080760,1.395950,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="152.101.4.0" dst_port="53"/>
        </slice>
        <from usec="0" sec="1226379870"/>
        <to usec="0" sec="1226379916"/>
    </anomaly>
    <anomaly type="suspicious" value="1.049300,1.359750,999,0 0 0 1 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_ip="157.80.197.202" dst_port="53"/>
            <filter dst_ip="221.153.198.134" dst_port="53"/>
        </slice>
        <from usec="0" sec="1226379600"/>
        <to usec="0" sec="1226380064"/>
    </anomaly>
    <anomaly type="suspicious" value="1.080760,1.395950,503,0 0 0 0 0 0 1 1 1 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="209.149.189.43" dst_ip="194.250.229.11" dst_port="80"/>
            <filter src_ip="209.149.189.43" dst_ip="76.170.229.227" dst_port="80"/>
        </slice>
        <from usec="0" sec="1226379870"/>
        <to usec="0" sec="1226379916"/>
    </anomaly>
    <anomaly type="suspicious" value="1.080760,1.395950,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="209.149.181.2" dst_port="53"/>
        </slice>
        <from usec="0" sec="1226379870"/>
        <to usec="0" sec="1226379916"/>
    </anomaly>
    <anomaly type="suspicious" value="1.080760,1.395950,503,0 0 0 0 0 0 1 1 1 0 0 0,salphfl">
        <slice>
            <filter src_ip="152.185.57.195" dst_ip="5.35.65.227" dst_port="80"/>
        </slice>
        <from usec="0" sec="1226379870"/>
        <to usec="0" sec="1226379916"/>
    </anomaly>
    <anomaly type="suspicious" value="1.080760,1.395950,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="152.185.53.40" dst_port="53"/>
        </slice>
        <from usec="0" sec="1226379870"/>
        <to usec="0" sec="1226379916"/>
    </anomaly>
    <anomaly type="suspicious" value="1.080760,1.395950,504,0 0 0 0 0 0 1 1 1 0 0 0,alphfl">
        <slice>
            <filter src_ip="4.6.91.69" dst_ip="157.80.194.141" src_port="443"/>
        </slice>
        <from usec="0" sec="1226379870"/>
        <to usec="0" sec="1226379916"/>
    </anomaly>
    <anomaly type="suspicious" value="1.080760,1.395950,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="200.18.44.158" src_port="35624" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1226379870"/>
        <to usec="0" sec="1226379916"/>
    </anomaly>
    <anomaly type="suspicious" value="1.080760,1.395950,010,0 0 0 0 0 0 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="0.45.4.14" src_port="80"/>
        </slice>
        <from usec="0" sec="1226379870"/>
        <to usec="0" sec="1226379916"/>
    </anomaly>
    <anomaly type="suspicious" value="1.080760,1.395950,011,0 0 0 0 0 0 1 1 1 0 0 0,DDoSRSTrp">
        <slice>
            <filter src_ip="200.64.136.188" src_port="80"/>
        </slice>
        <from usec="0" sec="1226379870"/>
        <to usec="0" sec="1226379916"/>
    </anomaly>
    <anomaly type="suspicious" value="1.144700,1.358680,503,1 0 0 1 0 0 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="157.80.133.119" dst_port="80"/>
        </slice>
        <from usec="0" sec="1226379602"/>
        <to usec="0" sec="1226380067"/>
    </anomaly>
    <anomaly type="suspicious" value="1.080760,1.395950,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="152.185.18.222" src_port="18579"/>
        </slice>
        <from usec="0" sec="1226379870"/>
        <to usec="0" sec="1226379916"/>
    </anomaly>
    <anomaly type="suspicious" value="1.080760,1.395950,503,0 0 0 0 0 0 1 1 1 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="122.178.114.240" dst_ip="209.149.189.33" dst_port="80"/>
            <filter src_ip="98.185.42.77" dst_ip="209.149.189.33" dst_port="80"/>
        </slice>
        <from usec="0" sec="1226379870"/>
        <to usec="0" sec="1226379916"/>
    </anomaly>
    <anomaly type="suspicious" value="1.080760,1.395950,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="205.103.91.104" src_port="1138" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1226379870"/>
        <to usec="0" sec="1226379916"/>
    </anomaly>
    <anomaly type="suspicious" value="1.080760,1.395950,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="1.90.146.204" src_port="4549" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1226379870"/>
        <to usec="0" sec="1226379916"/>
    </anomaly>
    <anomaly type="suspicious" value="1.080760,1.395950,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="201.224.245.11" src_port="1106" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1226379870"/>
        <to usec="0" sec="1226379916"/>
    </anomaly>
    <anomaly type="suspicious" value="1.080760,1.395950,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="200.29.40.30" src_port="1991" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1226379870"/>
        <to usec="0" sec="1226379916"/>
    </anomaly>
    <anomaly type="suspicious" value="1.080760,1.395950,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="5.168.60.130" src_port="1141" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1226379870"/>
        <to usec="0" sec="1226379916"/>
    </anomaly>
    <anomaly type="suspicious" value="1.080760,1.395950,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="208.216.34.66" src_port="1231" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1226379870"/>
        <to usec="0" sec="1226379916"/>
    </anomaly>
    <anomaly type="suspicious" value="1.080760,1.395950,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="0.165.157.94" src_port="1054" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1226379870"/>
        <to usec="0" sec="1226379916"/>
    </anomaly>
    <anomaly type="suspicious" value="1.080760,1.395950,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="200.105.24.114" src_port="1092" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1226379870"/>
        <to usec="0" sec="1226379916"/>
    </anomaly>
    <anomaly type="suspicious" value="1.049300,1.359750,999,0 0 0 1 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="165.68.247.50" dst_port="53"/>
        </slice>
        <from usec="0" sec="1226379600"/>
        <to usec="0" sec="1226380245"/>
    </anomaly>
    <anomaly type="suspicious" value="1.144700,1.358680,901,1 0 0 1 0 0 1 1 1 0 0 0,empty">
        <slice/>
        <from usec="0" sec="1226379600"/>
        <to usec="0" sec="1226380420"/>
    </anomaly>
    <anomaly type="suspicious" value="1.080760,1.395950,020,0 0 0 0 0 0 1 1 1 0 0 0,ntscICec">
        <slice>
            <filter src_ip="200.157.133.156"/>
        </slice>
        <from usec="0" sec="1226380275"/>
        <to usec="0" sec="1226380321"/>
    </anomaly>
    <anomaly type="suspicious" value="1.080760,1.395950,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="209.149.176.12" src_port="25"/>
            <filter src_ip="209.149.176.12" dst_port="53"/>
        </slice>
        <from usec="0" sec="1226380275"/>
        <to usec="0" sec="1226380321"/>
    </anomaly>
    <anomaly type="suspicious" value="1.049300,1.359750,999,0 0 0 1 0 0 1 1 1 0 0 0,mptpla">
        <slice>
            <filter src_ip="76.138.225.39" dst_ip="166.61.52.236" dst_port="62997"/>
            <filter src_ip="201.236.38.250" dst_ip="166.61.52.236" dst_port="62997"/>
        </slice>
        <from usec="0" sec="1226379601"/>
        <to usec="0" sec="1226380424"/>
    </anomaly>
    <anomaly type="suspicious" value="1.080760,1.395950,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="152.185.148.34" src_port="25"/>
            <filter src_ip="152.185.148.34" dst_port="53"/>
        </slice>
        <from usec="0" sec="1226380275"/>
        <to usec="0" sec="1226380321"/>
    </anomaly>
    <anomaly type="suspicious" value="1.049300,1.359750,999,0 0 0 1 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="152.185.135.71" src_port="61930"/>
            <filter src_ip="152.185.135.71" src_port="33969"/>
        </slice>
        <from usec="0" sec="1226379600"/>
        <to usec="0" sec="1226380321"/>
    </anomaly>
    <anomaly type="suspicious" value="1.080760,1.395950,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="157.80.55.236" src_port="53"/>
            <filter src_ip="157.80.55.236" dst_port="53"/>
        </slice>
        <from usec="0" sec="1226379870"/>
        <to usec="0" sec="1226380321"/>
    </anomaly>
    <anomaly type="suspicious" value="1.080760,1.395950,504,0 0 0 0 0 0 1 1 1 0 0 0,alphfl">
        <slice>
            <filter src_ip="157.80.194.169" dst_ip="4.17.141.200" dst_port="443"/>
        </slice>
        <from usec="0" sec="1226380275"/>
        <to usec="0" sec="1226380366"/>
    </anomaly>
    <anomaly type="suspicious" value="1.049300,1.359750,999,0 0 0 1 0 0 1 1 1 0 0 0,ptmpla">
        <slice>
            <filter src_ip="209.149.185.188" dst_ip="211.72.109.178" dst_port="53"/>
            <filter src_ip="209.149.185.188" dst_ip="221.60.36.197" dst_port="53"/>
            <filter src_ip="209.149.185.188" dst_ip="221.60.38.233" dst_port="53"/>
        </slice>
        <from usec="0" sec="1226379600"/>
        <to usec="0" sec="1226380321"/>
    </anomaly>
    <anomaly type="suspicious" value="1.080760,1.395950,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="157.80.197.202" dst_port="53"/>
        </slice>
        <from usec="0" sec="1226380275"/>
        <to usec="0" sec="1226380321"/>
    </anomaly>
    <anomaly type="suspicious" value="1.080760,1.395950,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="157.80.157.249" dst_port="53"/>
        </slice>
        <from usec="0" sec="1226380275"/>
        <to usec="0" sec="1226380321"/>
    </anomaly>
    <anomaly type="suspicious" value="1.080760,1.395950,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="157.80.190.124" dst_port="53"/>
        </slice>
        <from usec="0" sec="1226380275"/>
        <to usec="0" sec="1226380321"/>
    </anomaly>
    <anomaly type="suspicious" value="1.049300,1.359750,999,0 0 0 1 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="157.80.157.249" dst_port="53"/>
            <filter src_ip="165.68.246.192" dst_port="53"/>
        </slice>
        <from usec="0" sec="1226379618"/>
        <to usec="0" sec="1226380334"/>
    </anomaly>
    <anomaly type="suspicious" value="1.080760,1.395950,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="208.27.101.1" dst_port="53"/>
        </slice>
        <from usec="0" sec="1226380275"/>
        <to usec="0" sec="1226380321"/>
    </anomaly>
    <anomaly type="suspicious" value="1.080760,1.395950,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="152.185.53.40" dst_port="53"/>
        </slice>
        <from usec="0" sec="1226380275"/>
        <to usec="0" sec="1226380321"/>
    </anomaly>
    <anomaly type="suspicious" value="1.080760,1.395950,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="152.185.53.42" dst_port="53"/>
        </slice>
        <from usec="0" sec="1226380275"/>
        <to usec="0" sec="1226380321"/>
    </anomaly>
    <anomaly type="suspicious" value="1.080760,1.395950,503,0 0 0 0 0 0 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="157.80.154.218" dst_port="80"/>
        </slice>
        <from usec="0" sec="1226380275"/>
        <to usec="0" sec="1226380321"/>
    </anomaly>
    <anomaly type="suspicious" value="1.144700,1.358680,503,1 0 0 1 0 0 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="208.27.91.91" dst_port="53"/>
            <filter src_ip="208.27.91.91" dst_port="80"/>
        </slice>
        <from usec="0" sec="1226379600"/>
        <to usec="0" sec="1226380426"/>
    </anomaly>
    <anomaly type="suspicious" value="1.080760,1.395950,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="209.149.181.31" src_port="53"/>
        </slice>
        <from usec="0" sec="1226379870"/>
        <to usec="0" sec="1226380321"/>
    </anomaly>
    <anomaly type="suspicious" value="1.049300,1.359750,503,0 0 0 1 0 0 1 1 1 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="152.185.52.224" dst_ip="7.162.108.89" dst_port="80"/>
            <filter src_ip="152.185.52.224" dst_ip="7.162.108.90" dst_port="80"/>
        </slice>
        <from usec="0" sec="1226380138"/>
        <to usec="0" sec="1226380362"/>
    </anomaly>
    <anomaly type="suspicious" value="1.080760,1.395950,503,0 0 0 0 0 0 1 1 1 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="152.185.52.235" dst_ip="209.20.102.111" dst_port="80"/>
            <filter src_ip="152.185.52.235" dst_ip="209.20.102.84" dst_port="80"/>
        </slice>
        <from usec="0" sec="1226380275"/>
        <to usec="0" sec="1226380321"/>
    </anomaly>
    <anomaly type="suspicious" value="1.080760,1.395950,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="200.18.44.158" src_port="35624" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1226380275"/>
        <to usec="0" sec="1226380321"/>
    </anomaly>
    <anomaly type="suspicious" value="1.080760,1.395950,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="152.185.66.84" src_port="18670"/>
        </slice>
        <from usec="0" sec="1226379870"/>
        <to usec="0" sec="1226380321"/>
    </anomaly>
    <anomaly type="suspicious" value="1.080760,1.395950,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="152.185.53.65" src_port="53"/>
            <filter src_ip="152.185.53.65" dst_port="53"/>
        </slice>
        <from usec="0" sec="1226379870"/>
        <to usec="0" sec="1226380321"/>
    </anomaly>
    <anomaly type="suspicious" value="1.080760,1.395950,503,0 0 0 0 0 0 1 1 1 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="157.80.133.119" dst_ip="169.150.218.66" dst_port="80"/>
        </slice>
        <from usec="0" sec="1226380275"/>
        <to usec="0" sec="1226380321"/>
    </anomaly>
    <anomaly type="suspicious" value="1.080760,1.395950,503,0 0 0 0 0 0 1 1 1 0 0 0,salphfl">
        <slice>
            <filter src_ip="212.60.73.150" dst_ip="208.27.91.91" src_port="80"/>
        </slice>
        <from usec="0" sec="1226380275"/>
        <to usec="0" sec="1226380321"/>
    </anomaly>
    <anomaly type="suspicious" value="1.080760,1.395950,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="209.149.178.129" dst_port="53"/>
        </slice>
        <from usec="0" sec="1226380275"/>
        <to usec="0" sec="1226380321"/>
    </anomaly>
    <anomaly type="suspicious" value="1.080760,1.395950,999,0 0 0 0 0 0 1 1 1 0 0 0,alphfl">
        <slice>
            <filter src_ip="201.225.108.114" dst_ip="152.69.232.243" dst_port="26287"/>
        </slice>
        <from usec="0" sec="1226379870"/>
        <to usec="0" sec="1226380366"/>
    </anomaly>
    <anomaly type="suspicious" value="1.080760,1.395950,999,0 0 0 0 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_ip="194.174.223.153" dst_ip="160.23.220.163"/>
            <filter src_ip="194.174.223.153" dst_ip="160.23.213.212"/>
            <filter src_ip="194.174.223.153" dst_port="53"/>
            <filter src_ip="194.174.223.156" dst_ip="160.23.220.163"/>
            <filter src_ip="194.174.223.156" dst_ip="160.23.213.212"/>
            <filter src_ip="194.174.223.156" dst_port="53"/>
            <filter dst_ip="160.23.220.163" dst_port="53"/>
            <filter dst_ip="160.23.221.127" dst_port="53"/>
            <filter dst_ip="160.23.213.212" dst_port="53"/>
        </slice>
        <from usec="0" sec="1226379600"/>
        <to usec="0" sec="1226380366"/>
    </anomaly>
    <anomaly type="suspicious" value="1.080760,1.395950,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="200.104.15.83" src_port="1263" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1226380275"/>
        <to usec="0" sec="1226380321"/>
    </anomaly>
    <anomaly type="suspicious" value="1.080760,1.395950,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="205.103.91.104" src_port="1138" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1226380275"/>
        <to usec="0" sec="1226380321"/>
    </anomaly>
    <anomaly type="suspicious" value="1.080760,1.395950,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="1.90.146.204" src_port="4549" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1226380275"/>
        <to usec="0" sec="1226380321"/>
    </anomaly>
    <anomaly type="suspicious" value="1.080760,1.395950,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="204.84.177.138" src_port="4096" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1226380275"/>
        <to usec="0" sec="1226380321"/>
    </anomaly>
    <anomaly type="suspicious" value="1.080760,1.395950,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="201.224.245.11" src_port="1106" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1226380275"/>
        <to usec="0" sec="1226380321"/>
    </anomaly>
    <anomaly type="suspicious" value="1.080760,1.395950,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="200.29.40.30" src_port="1991" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1226380275"/>
        <to usec="0" sec="1226380321"/>
    </anomaly>
    <anomaly type="suspicious" value="1.080760,1.395950,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="5.168.60.130" src_port="1141" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1226380275"/>
        <to usec="0" sec="1226380321"/>
    </anomaly>
    <anomaly type="suspicious" value="1.080760,1.395950,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="208.216.34.66" src_port="1231" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1226380275"/>
        <to usec="0" sec="1226380321"/>
    </anomaly>
    <anomaly type="suspicious" value="1.080760,1.395950,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="0.165.157.94" src_port="1054" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1226380275"/>
        <to usec="0" sec="1226380321"/>
    </anomaly>
    <anomaly type="suspicious" value="1.173610,1.394900,999,1 0 0 0 0 0 1 1 1 0 0 0,rflatDNS">
        <slice>
            <filter src_ip="194.174.218.32" dst_ip="160.23.221.127"/>
            <filter dst_ip="160.23.221.127" src_port="53"/>
            <filter src_ip="194.174.218.32" dst_ip="160.23.220.163" src_port="53"/>
            <filter src_ip="194.174.216.50" dst_ip="160.23.220.163" src_port="53"/>
        </slice>
        <from usec="0" sec="1226379600"/>
        <to usec="0" sec="1226380366"/>
    </anomaly>
    <anomaly type="suspicious" value="1.080760,1.395950,999,0 0 0 0 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_ip="165.68.247.50" dst_port="53"/>
            <filter dst_ip="221.44.166.105" dst_port="53"/>
        </slice>
        <from usec="0" sec="1226380275"/>
        <to usec="0" sec="1226380366"/>
    </anomaly>
    <anomaly type="suspicious" value="1.049300,1.359750,999,0 0 0 1 0 0 1 1 1 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="208.179.18.102" dst_ip="10.0.2.37" src_port="53"/>
        </slice>
        <from usec="0" sec="1226379600"/>
        <to usec="0" sec="1226380427"/>
    </anomaly>
    <anomaly type="suspicious" value="0.927862,1.338660,503,0 0 0 0 0 0 0 0 0 1 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="157.80.158.73"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.927862,1.338660,999,0 0 0 0 0 0 0 0 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="165.68.132.118"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.927862,1.338660,503,0 0 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="200.116.154.177"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.927862,1.338660,999,0 0 0 0 0 0 0 0 0 1 0 0,ptmpla">
        <slice>
            <filter src_ip="5.65.99.159"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.385840,1.406680,503,0 0 0 1 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="209.149.180.150" dst_ip="76.218.5.231" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.927862,1.338660,503,0 0 0 0 0 0 0 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="158.24.90.191"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.927862,1.338660,503,0 0 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter dst_ip="157.80.19.92"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.001610,1.299750,999,1 0 0 1 0 0 0 0 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="152.185.53.69" dst_port="25"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.927862,1.338660,011,0 0 0 0 0 0 0 0 0 1 0 0,point_to_point">
        <slice>
            <filter dst_ip="152.185.71.130"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.385840,1.406680,503,0 0 0 1 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="200.96.50.43" dst_ip="165.68.113.24" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.927862,1.338660,999,0 0 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter dst_ip="209.222.43.96"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.927862,1.338660,503,0 0 0 0 0 0 0 0 0 1 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="156.52.233.145" dst_ip="98.150.170.73" src_port="80"/>
            <filter src_ip="157.80.158.80" dst_ip="98.150.170.73" src_port="8888"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.927862,1.338660,503,0 0 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="156.52.12.0" dst_ip="98.150.161.181" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.385840,1.406680,503,0 0 0 1 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter dst_ip="157.80.161.36" src_port="80"/>
            <filter src_ip="208.130.83.113" dst_ip="152.185.23.49" src_port="80"/>
            <filter src_ip="208.130.83.113" dst_ip="152.185.240.184" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.409810,1.441700,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="201.2.194.169" dst_ip="152.185.64.237" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.409810,1.441700,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="1.179.136.100" dst_ip="152.185.65.225" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.409810,1.441700,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="0.133.65.242" dst_ip="157.80.179.203" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.409810,1.441700,503,0 0 0 0 0 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter src_ip="194.172.152.1" dst_ip="165.68.10.226" src_port="80" dst_port="36654"/>
            <filter src_ip="97.114.7.71" dst_ip="165.68.10.226" src_port="80" dst_port="38191"/>
            <filter src_ip="194.130.248.242" dst_ip="165.68.10.226" src_port="80" dst_port="36383"/>
            <filter src_ip="197.141.118.76" dst_ip="165.68.10.226" src_port="80" dst_port="44342"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.409810,1.441700,503,0 0 0 0 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="208.23.176.16" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.409810,1.441700,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="195.166.108.29" dst_ip="208.23.165.135" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.385840,1.406680,503,0 0 0 1 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter dst_ip="157.80.194.140" src_port="80"/>
            <filter dst_ip="208.23.52.250" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
