<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="anomalous" value="2.572180,2.410710,020,1 1 1 0 0 0 0 0 0 0 0 0,ptpDoSIC">
        <slice>
            <filter src_ip="215.40.233.143" dst_ip="49.20.181.119"/>
        </slice>
        <from usec="0" sec="1229058011"/>
        <to usec="0" sec="1229058857"/>
    </anomaly>
    <anomaly type="anomalous" value="2.572180,2.410710,503,1 1 1 0 0 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="133.72.88.76" dst_port="80"/>
            <filter src_ip="133.72.88.76" dst_port="53"/>
        </slice>
        <from usec="0" sec="1229058134"/>
        <to usec="0" sec="1229058731"/>
    </anomaly>
    <anomaly type="anomalous" value="2.572180,2.410710,999,1 1 1 0 0 0 0 0 0 0 0 0,ipv4gretun">
        <slice>
            <filter src_ip="206.175.154.60" dst_ip="214.56.220.20"/>
            <filter src_ip="215.8.92.141" dst_ip="214.56.220.20"/>
        </slice>
        <from usec="0" sec="1229058038"/>
        <to usec="0" sec="1229058899"/>
    </anomaly>
    <anomaly type="anomalous" value="3.961260,2.925570,999,1 1 1 1 1 1 0 0 0 1 1 1,ptmpla">
        <slice>
            <filter src_ip="133.72.57.186" dst_ip="61.128.163.157"/>
            <filter src_ip="133.72.57.186" dst_ip="36.164.113.84"/>
            <filter src_ip="133.72.57.186" dst_ip="192.22.41.163" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.071770,1.840630,503,0 0 0 1 1 1 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="116.36.202.199" dst_ip="128.64.202.1" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.881920,1.574480,503,1 0 0 1 1 0 0 0 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="215.40.227.25" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.136660,2.606620,503,1 1 1 1 1 1 0 0 0 0 0 0,mptmp">
        <slice>
            <filter dst_ip="174.194.16.142" src_port="80"/>
            <filter src_ip="41.100.134.14" dst_ip="214.56.220.81" src_port="80"/>
        </slice>
        <from usec="0" sec="1229058000"/>
        <to usec="0" sec="1229058899"/>
    </anomaly>
    <anomaly type="anomalous" value="1.881920,1.574480,503,1 0 0 1 1 0 0 0 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="133.72.2.38" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.045810,2.260550,503,0 0 0 1 1 1 0 0 0 1 1 1,malphfl">
        <slice>
            <filter src_ip="101.84.16.219" dst_ip="128.64.43.192" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.057530,2.244140,503,1 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="215.40.229.190" src_port="80"/>
            <filter src_ip="215.40.229.191" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.788280,2.375990,503,1 1 1 1 1 0 1 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="214.56.220.81" dst_port="80"/>
        </slice>
        <from usec="0" sec="1229058000"/>
        <to usec="0" sec="1229058869"/>
    </anomaly>
    <anomaly type="anomalous" value="1.989290,1.772920,999,1 0 0 1 1 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="214.49.6.252" src_port="20265"/>
        </slice>
        <from usec="0" sec="1229058000"/>
        <to usec="0" sec="1229058738"/>
    </anomaly>
    <anomaly type="anomalous" value="3.194680,2.240090,503,1 1 0 1 1 0 1 1 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="215.40.233.13" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.196700,1.784820,999,1 0 0 1 1 0 1 1 1 1 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="174.194.172.148"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.698960,1.971550,503,1 0 0 1 1 0 1 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="133.72.2.38" src_port="80"/>
            <filter src_ip="100.176.17.20" dst_ip="133.72.152.32" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.071770,1.840630,503,0 0 0 1 1 1 0 0 0 1 0 0,point_to_point">
        <slice>
            <filter src_ip="214.184.106.67" dst_ip="128.64.202.15" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.045810,2.260550,503,0 0 0 1 1 1 0 0 0 1 1 1,malphfl">
        <slice>
            <filter src_ip="128.64.117.67" dst_ip="41.207.126.40" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.071770,1.840630,503,0 0 0 1 1 1 0 0 0 1 0 0,malphfl">
        <slice>
            <filter src_ip="192.22.44.140" dst_ip="128.208.132.29" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.850420,1.829100,011,0 0 0 1 1 1 0 0 0 0 0 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="201.209.85.219" src_port="1080"/>
            <filter dst_ip="201.209.85.219"/>
            <filter dst_ip="201.209.85.219"/>
        </slice>
        <from usec="0" sec="1229058000"/>
        <to usec="0" sec="1229058828"/>
    </anomaly>
    <anomaly type="anomalous" value="2.465530,1.935560,503,0 0 0 1 1 1 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="42.220.116.29" dst_ip="174.194.18.218" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.021440,1.588500,503,1 0 0 1 1 0 1 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="215.40.227.25" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.112330,2.622330,010,1 1 1 0 0 0 1 1 1 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="196.219.165.233" dst_port="139"/>
        </slice>
        <from usec="0" sec="1229058012"/>
        <to usec="0" sec="1229058899"/>
    </anomaly>
    <anomaly type="anomalous" value="2.561310,2.377150,503,1 1 1 1 0 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="133.72.57.36" dst_port="80"/>
            <filter src_ip="174.194.91.152" dst_port="80"/>
            <filter dst_ip="214.57.103.32" dst_port="80"/>
        </slice>
        <from usec="0" sec="1229058000"/>
        <to usec="0" sec="1229058895"/>
    </anomaly>
    <anomaly type="anomalous" value="2.801110,2.093030,999,1 1 0 1 0 0 1 1 1 1 1 0,mptmp">
        <slice>
            <filter dst_ip="215.40.224.2"/>
            <filter dst_ip="215.40.237.177"/>
            <filter dst_ip="215.40.237.177"/>
            <filter dst_ip="215.40.224.3"/>
            <filter dst_ip="215.40.224.3"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="4.019110,2.903550,503,1 1 1 1 1 0 1 1 1 1 1 1,mptmp">
        <slice>
            <filter dst_ip="215.40.229.190" dst_port="80"/>
            <filter dst_ip="215.40.229.191" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="4.331520,3.102270,020,1 1 1 1 1 1 1 1 1 1 1 1,ptmp">
        <slice>
            <filter src_ip="201.209.85.219"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.989290,1.772920,999,1 0 0 1 1 0 1 1 1 0 0 0,rflatDNS">
        <slice>
            <filter dst_ip="214.56.197.156" src_port="53"/>
            <filter dst_ip="174.194.132.143" src_port="53"/>
        </slice>
        <from usec="0" sec="1229058000"/>
        <to usec="0" sec="1229058734"/>
    </anomaly>
    <anomaly type="anomalous" value="1.813210,1.786930,999,1 0 0 1 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="216.36.61.210" dst_port="53"/>
            <filter dst_ip="216.36.61.212" dst_port="53"/>
        </slice>
        <from usec="0" sec="1229058000"/>
        <to usec="0" sec="1229058898"/>
    </anomaly>
    <anomaly type="anomalous" value="2.571400,1.882570,999,1 0 0 1 1 0 1 1 1 1 1 0,mptmp">
        <slice>
            <filter src_ip="174.194.132.143" dst_port="53"/>
            <filter dst_ip="216.186.176.137" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.989290,1.772920,503,1 0 0 1 1 0 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="85.215.16.215" dst_port="80"/>
            <filter dst_ip="85.215.16.215" dst_port="443"/>
        </slice>
        <from usec="0" sec="1229058000"/>
        <to usec="0" sec="1229058645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.813210,1.786930,503,1 0 0 1 0 0 1 1 1 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="133.72.128.85" dst_ip="165.181.120.204" dst_port="80"/>
        </slice>
        <from usec="0" sec="1229058000"/>
        <to usec="0" sec="1229058898"/>
    </anomaly>
    <anomaly type="anomalous" value="1.989290,1.772920,501,1 0 0 1 1 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="169.18.162.241" dst_port="21"/>
        </slice>
        <from usec="0" sec="1229058000"/>
        <to usec="0" sec="1229058828"/>
    </anomaly>
    <anomaly type="anomalous" value="3.132130,2.215350,999,1 0 0 1 1 0 1 1 1 1 1 1,ntscUDP">
        <slice>
            <filter src_ip="216.36.61.210" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.813210,1.786930,999,1 0 0 1 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="214.49.21.72" src_port="15112"/>
        </slice>
        <from usec="0" sec="1229058000"/>
        <to usec="0" sec="1229058899"/>
    </anomaly>
    <anomaly type="anomalous" value="1.813210,1.786930,999,1 0 0 1 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="214.49.2.247" src_port="7596"/>
        </slice>
        <from usec="0" sec="1229058000"/>
        <to usec="0" sec="1229058862"/>
    </anomaly>
    <anomaly type="anomalous" value="3.057530,2.244140,020,1 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="193.132.70.217" dst_port="80"/>
            <filter src_ip="133.72.147.74" dst_ip="203.145.142.232" dst_port="80"/>
            <filter dst_ip="193.132.70.217"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.465530,1.935560,503,0 0 0 1 1 1 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="215.40.237.176" src_port="21"/>
            <filter src_ip="133.72.132.143" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.133940,2.270340,010,0 0 0 1 1 1 1 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="1.132.169.73" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.185350,1.820910,503,1 1 0 1 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="216.8.46.4" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.437730,1.895770,501,1 0 0 1 0 0 1 1 1 1 1 0,heavy_hitter">
        <slice>
            <filter src_ip="0.141.4.43" dst_ip="215.40.237.176" dst_port="21"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.465530,1.935560,503,0 0 0 1 1 1 0 0 0 1 1 0,mptmp">
        <slice>
            <filter dst_ip="133.72.206.40"/>
            <filter dst_ip="128.87.90.183" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.434650,2.422260,503,1 1 0 1 1 1 1 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="214.49.185.51" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.881920,1.574480,503,1 0 0 1 1 0 0 0 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="215.40.233.13" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.045810,2.260550,503,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="214.49.185.51" src_port="80"/>
            <filter src_ip="200.72.96.159" src_port="2653" dst_port="1434"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.582290,1.979040,503,0 0 0 1 1 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="101.84.25.203" dst_ip="214.49.184.145" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.324770,1.456190,503,1 0 0 1 1 0 0 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="174.194.172.224" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.068290,1.526780,503,1 0 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="174.194.92.102" dst_ip="210.243.63.191" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.475380,1.753730,503,1 1 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="133.72.163.141" dst_ip="100.175.96.128" src_port="2707" dst_port="80"/>
            <filter src_ip="133.72.163.141" dst_ip="100.175.96.128" src_port="2705" dst_port="80"/>
            <filter src_ip="133.72.163.141" dst_ip="215.0.110.176" src_port="2709" dst_port="80"/>
        </slice>
        <from usec="0" sec="1229058851"/>
        <to usec="0" sec="1229058855"/>
    </anomaly>
    <anomaly type="suspicious" value="1.475380,1.753730,504,1 1 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="133.72.131.217" dst_ip="214.95.100.41" src_port="1894" dst_port="443"/>
            <filter src_ip="133.72.131.217" dst_ip="214.95.100.41" src_port="1892" dst_port="443"/>
            <filter src_ip="133.72.131.217" dst_ip="219.10.219.33" src_port="1896" dst_port="443"/>
        </slice>
        <from usec="0" sec="1229058109"/>
        <to usec="0" sec="1229058113"/>
    </anomaly>
    <anomaly type="suspicious" value="1.475380,1.753730,901,1 1 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="174.194.18.218" dst_ip="116.33.65.222" dst_port="80"/>
            <filter src_ip="174.194.18.218" dst_ip="116.33.65.183" dst_port="80"/>
        </slice>
        <from usec="0" sec="1229058894"/>
        <to usec="0" sec="1229058898"/>
    </anomaly>
    <anomaly type="suspicious" value="1.475380,1.753730,002,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="1.40.144.48" src_port="35202" dst_port="137"/>
        </slice>
        <from usec="0" sec="1229058120"/>
        <to usec="0" sec="1229058135"/>
    </anomaly>
    <anomaly type="suspicious" value="1.649650,1.766320,002,1 1 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="1.194.89.80" src_port="10000" dst_port="137"/>
        </slice>
        <from usec="0" sec="1229058405"/>
        <to usec="0" sec="1229058451"/>
    </anomaly>
    <anomaly type="suspicious" value="1.475380,1.753730,002,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="101.183.50.92" src_port="1071" dst_port="137"/>
        </slice>
        <from usec="0" sec="1229058295"/>
        <to usec="0" sec="1229058308"/>
    </anomaly>
    <anomaly type="suspicious" value="1.475380,1.753730,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="59.209.208.145" dst_port="139"/>
            <filter src_ip="59.209.208.145" dst_port="445"/>
        </slice>
        <from usec="0" sec="1229058046"/>
        <to usec="0" sec="1229058138"/>
    </anomaly>
    <anomaly type="suspicious" value="1.632660,1.720240,010,1 1 0 1 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="38.125.1.23" dst_port="135"/>
        </slice>
        <from usec="0" sec="1229058000"/>
        <to usec="0" sec="1229058898"/>
    </anomaly>
    <anomaly type="suspicious" value="1.041850,1.473220,503,1 0 0 1 0 0 0 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="204.100.229.35" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.324770,1.456190,503,1 0 0 1 1 0 0 0 0 1 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="174.194.172.224" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.006940,1.498100,999,0 0 0 1 0 0 0 0 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="215.40.226.2" src_port="51413"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.670490,1.692630,503,1 1 0 1 1 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="192.70.169.74" dst_ip="214.56.220.81" src_port="80"/>
        </slice>
        <from usec="0" sec="1229058008"/>
        <to usec="0" sec="1229058817"/>
    </anomaly>
    <anomaly type="suspicious" value="1.334090,1.586360,999,1 0 0 1 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="214.49.21.72" dst_port="15112"/>
        </slice>
        <from usec="0" sec="1229058000"/>
        <to usec="0" sec="1229058828"/>
    </anomaly>
    <anomaly type="suspicious" value="1.307010,1.609500,999,0 0 0 1 0 0 1 1 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="128.64.235.244" src_port="49763"/>
        </slice>
        <from usec="0" sec="1229058000"/>
        <to usec="0" sec="1229058811"/>
    </anomaly>
    <anomaly type="suspicious" value="1.307010,1.609500,999,0 0 0 1 0 0 1 1 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="216.55.169.197" src_port="6667"/>
        </slice>
        <from usec="0" sec="1229058000"/>
        <to usec="0" sec="1229058468"/>
    </anomaly>
    <anomaly type="suspicious" value="1.328180,1.658660,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="133.72.21.88" dst_port="53"/>
        </slice>
        <from usec="0" sec="1229058135"/>
        <to usec="0" sec="1229058181"/>
    </anomaly>
    <anomaly type="suspicious" value="1.307010,1.609500,999,0 0 0 1 0 0 1 1 0 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="214.217.183.49" dst_ip="10.168.10.101" src_port="53"/>
        </slice>
        <from usec="0" sec="1229058000"/>
        <to usec="0" sec="1229058827"/>
    </anomaly>
    <anomaly type="suspicious" value="1.808860,1.851420,020,0 0 0 0 0 0 1 1 1 0 0 0,ntscICec">
        <slice>
            <filter src_ip="200.139.154.175"/>
        </slice>
        <from usec="0" sec="1229058000"/>
        <to usec="0" sec="1229058046"/>
    </anomaly>
    <anomaly type="suspicious" value="1.828530,1.831340,010,1 0 0 0 0 0 1 1 1 0 0 0,DDoSSYN">
        <slice>
            <filter dst_ip="215.40.224.8" dst_port="3128"/>
        </slice>
        <from usec="0" sec="1229058000"/>
        <to usec="0" sec="1229058309"/>
    </anomaly>
    <anomaly type="suspicious" value="1.808860,1.851420,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="215.40.237.160" dst_port="16881"/>
        </slice>
        <from usec="0" sec="1229058000"/>
        <to usec="0" sec="1229058271"/>
    </anomaly>
    <anomaly type="suspicious" value="1.808860,1.851420,020,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPICdurp">
        <slice>
            <filter dst_ip="40.224.18.137"/>
        </slice>
        <from usec="0" sec="1229058000"/>
        <to usec="0" sec="1229058046"/>
    </anomaly>
    <anomaly type="suspicious" value="1.328180,1.658660,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="215.40.232.165" dst_port="53"/>
        </slice>
        <from usec="0" sec="1229058000"/>
        <to usec="0" sec="1229058046"/>
    </anomaly>
    <anomaly type="suspicious" value="1.808860,1.851420,999,0 0 0 0 0 0 1 1 1 0 0 0,mptpla">
        <slice>
            <filter src_ip="205.207.34.214" dst_ip="214.56.201.59" dst_port="7733"/>
            <filter src_ip="205.204.121.188" dst_ip="214.56.201.59" dst_port="9781"/>
        </slice>
        <from usec="0" sec="1229058000"/>
        <to usec="0" sec="1229058046"/>
    </anomaly>
    <anomaly type="suspicious" value="1.793380,1.807500,999,0 0 0 1 0 0 1 1 1 0 0 0,mptpla">
        <slice>
            <filter src_ip="100.42.144.39" dst_ip="154.79.242.186" dst_port="62997"/>
            <filter src_ip="205.208.84.196" dst_ip="154.79.242.186" dst_port="62997"/>
        </slice>
        <from usec="0" sec="1229058000"/>
        <to usec="0" sec="1229058639"/>
    </anomaly>
    <anomaly type="suspicious" value="1.328180,1.658660,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="169.18.166.220" src_port="53"/>
            <filter dst_ip="169.18.166.220" dst_port="53"/>
        </slice>
        <from usec="0" sec="1229058000"/>
        <to usec="0" sec="1229058271"/>
    </anomaly>
    <anomaly type="suspicious" value="1.808860,1.851420,999,0 0 0 0 0 0 1 1 1 0 0 0,mptpla">
        <slice>
            <filter src_ip="4.92.43.123" dst_ip="214.56.200.239" dst_port="62997"/>
            <filter src_ip="201.192.197.172" dst_ip="214.56.200.239" dst_port="62997"/>
        </slice>
        <from usec="0" sec="1229058000"/>
        <to usec="0" sec="1229058046"/>
    </anomaly>
    <anomaly type="suspicious" value="1.808860,1.851420,010,0 0 0 0 0 0 1 1 1 0 0 0,DDoSSYN">
        <slice>
            <filter dst_ip="128.64.203.135" dst_port="25"/>
        </slice>
        <from usec="0" sec="1229058000"/>
        <to usec="0" sec="1229058046"/>
    </anomaly>
    <anomaly type="suspicious" value="1.307010,1.609500,999,0 0 0 1 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="214.56.220.165"/>
        </slice>
        <from usec="0" sec="1229058000"/>
        <to usec="0" sec="1229058606"/>
    </anomaly>
    <anomaly type="suspicious" value="1.793380,1.807500,999,0 0 0 1 0 0 1 1 1 0 0 0,alphfl">
        <slice>
            <filter src_ip="96.170.223.180" dst_ip="172.45.36.2" dst_port="62997"/>
        </slice>
        <from usec="0" sec="1229058000"/>
        <to usec="0" sec="1229058558"/>
    </anomaly>
    <anomaly type="suspicious" value="1.793380,1.807500,999,0 0 0 1 0 0 1 1 1 0 0 0,salphfl">
        <slice>
            <filter src_ip="100.131.104.189" dst_ip="154.79.11.252" dst_port="62997"/>
        </slice>
        <from usec="0" sec="1229058000"/>
        <to usec="0" sec="1229058555"/>
    </anomaly>
    <anomaly type="suspicious" value="1.328180,1.658660,020,0 0 0 0 0 0 1 1 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="200.139.154.175"/>
        </slice>
        <from usec="0" sec="1229058135"/>
        <to usec="0" sec="1229058181"/>
    </anomaly>
    <anomaly type="suspicious" value="1.808860,1.851420,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="214.49.2.247" src_port="7596"/>
        </slice>
        <from usec="0" sec="1229058135"/>
        <to usec="0" sec="1229058181"/>
    </anomaly>
    <anomaly type="suspicious" value="1.828530,1.831340,999,1 0 0 0 0 0 1 1 1 0 0 0,rflatDNS">
        <slice>
            <filter dst_ip="169.18.169.98" src_port="53"/>
            <filter src_ip="193.238.186.51" dst_ip="169.18.168.226" src_port="53"/>
            <filter src_ip="193.238.185.64" dst_ip="169.18.168.226" src_port="53"/>
        </slice>
        <from usec="0" sec="1229058000"/>
        <to usec="0" sec="1229058811"/>
    </anomaly>
    <anomaly type="suspicious" value="1.328180,1.658660,012,0 0 0 0 0 0 1 1 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="85.215.16.215" dst_ip="215.40.238.200" src_port="80"/>
        </slice>
        <from usec="0" sec="1229058765"/>
        <to usec="0" sec="1229058811"/>
    </anomaly>
    <anomaly type="suspicious" value="1.328180,1.658660,010,0 0 0 0 0 0 1 1 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="206.96.90.83" src_port="80"/>
        </slice>
        <from usec="0" sec="1229058765"/>
        <to usec="0" sec="1229058811"/>
    </anomaly>
    <anomaly type="suspicious" value="1.808860,1.851420,503,0 0 0 0 0 0 1 1 1 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="214.45.54.4" dst_ip="128.87.90.181" src_port="80"/>
        </slice>
        <from usec="0" sec="1229058765"/>
        <to usec="0" sec="1229058811"/>
    </anomaly>
    <anomaly type="suspicious" value="1.328180,1.658660,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="214.56.229.59" dst_port="53"/>
        </slice>
        <from usec="0" sec="1229058765"/>
        <to usec="0" sec="1229058811"/>
    </anomaly>
    <anomaly type="suspicious" value="1.034270,1.550800,503,0 0 0 0 0 0 0 0 0 1 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="128.81.73.245"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.006940,1.498100,503,0 0 0 1 0 0 0 0 0 1 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="128.81.64.89" dst_ip="41.207.122.102" src_port="80"/>
            <filter src_ip="128.81.64.89" dst_ip="41.207.122.107" src_port="80"/>
            <filter src_ip="128.81.64.89" dst_ip="41.207.122.103" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.034270,1.550800,503,0 0 0 0 0 0 0 0 0 1 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="128.81.250.205"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.034270,1.550800,503,0 0 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="128.81.248.223"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.068290,1.526780,503,1 0 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="211.140.116.92" dst_ip="214.49.0.231" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.034270,1.550800,503,0 0 0 0 0 0 0 0 0 1 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="210.243.63.191"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.034270,1.550800,503,0 0 0 0 0 0 0 0 0 1 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="133.72.75.21"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.034270,1.550800,503,0 0 0 0 0 0 0 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="133.72.88.207"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.034270,1.550800,503,0 0 0 0 0 0 0 0 0 1 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="174.194.18.4"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.034270,1.550800,999,0 0 0 0 0 0 0 0 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="169.18.166.137"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.068290,1.526780,503,1 0 0 0 0 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="133.72.119.110" dst_ip="211.140.116.92"/>
            <filter src_ip="133.72.119.110" dst_port="80"/>
            <filter src_ip="214.49.0.231" dst_ip="211.140.116.92" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.034270,1.550800,999,0 0 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter dst_ip="116.55.4.215"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.034270,1.550800,503,0 0 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter dst_ip="42.220.116.24"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.068290,1.526780,503,1 0 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="128.81.14.165" dst_ip="41.207.125.78" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.034270,1.550800,503,0 0 0 0 0 0 0 0 0 1 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="41.207.116.17"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
