<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="anomalous" value="1.402540,1.165460,503,1 1 0 1 1 0 1 1 1 0 0 0,ntscACK">
        <slice>
            <filter src_ip="154.101.230.149" src_port="80"/>
        </slice>
        <from usec="0" sec="1230786001"/>
        <to usec="0" sec="1230786805"/>
    </anomaly>
    <anomaly type="anomalous" value="1.504470,1.328620,503,1 1 1 1 1 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="154.101.230.149" dst_port="80"/>
        </slice>
        <from usec="0" sec="1230786039"/>
        <to usec="0" sec="1230786901"/>
    </anomaly>
    <anomaly type="anomalous" value="1.238080,1.169490,503,1 1 1 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="154.101.171.24" dst_ip="193.27.163.87" dst_port="80"/>
        </slice>
        <from usec="0" sec="1230786218"/>
        <to usec="0" sec="1230786872"/>
    </anomaly>
    <anomaly type="anomalous" value="1.304430,1.183480,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="194.33.111.13" dst_port="23"/>
        </slice>
        <from usec="0" sec="1230786379"/>
        <to usec="0" sec="1230786587"/>
    </anomaly>
    <anomaly type="anomalous" value="1.304430,1.183480,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="200.128.184.22" dst_port="139"/>
        </slice>
        <from usec="0" sec="1230786623"/>
        <to usec="0" sec="1230786806"/>
    </anomaly>
    <anomaly type="anomalous" value="1.238080,1.169490,503,1 1 1 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="164.114.145.250" dst_ip="53.53.71.229" src_port="57455" dst_port="80"/>
        </slice>
        <from usec="0" sec="1230786723"/>
        <to usec="0" sec="1230786727"/>
    </anomaly>
    <anomaly type="anomalous" value="1.273170,1.182240,999,1 1 1 1 0 0 0 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="192.231.29.19" src_port="53"/>
            <filter src_ip="203.215.60.6" dst_ip="154.101.192.248" src_port="53"/>
        </slice>
        <from usec="0" sec="1230786001"/>
        <to usec="0" sec="1230786559"/>
    </anomaly>
    <anomaly type="anomalous" value="1.238080,1.169490,503,1 1 1 0 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter src_ip="49.100.30.109" dst_ip="192.231.31.65"/>
            <filter dst_ip="192.231.31.65" dst_port="80"/>
        </slice>
        <from usec="0" sec="1230786758"/>
        <to usec="0" sec="1230786763"/>
    </anomaly>
    <anomaly type="anomalous" value="1.238080,1.169490,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="13.233.218.35"/>
        </slice>
        <from usec="0" sec="1230786206"/>
        <to usec="0" sec="1230786283"/>
    </anomaly>
    <anomaly type="anomalous" value="1.150940,0.995362,502,1 1 0 1 0 0 1 1 1 0 0 0,ptmpla">
        <slice>
            <filter src_ip="35.44.26.106" dst_port="22"/>
        </slice>
        <from usec="0" sec="1230786001"/>
        <to usec="0" sec="1230786829"/>
    </anomaly>
    <anomaly type="anomalous" value="1.521530,1.288710,010,1 1 1 0 0 0 1 1 1 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="13.233.218.35" dst_port="25"/>
        </slice>
        <from usec="0" sec="1230786181"/>
        <to usec="0" sec="1230786286"/>
    </anomaly>
    <anomaly type="anomalous" value="2.127790,1.760420,010,1 1 1 1 1 1 1 1 1 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="4.183.81.198" src_port="6000" dst_port="2967"/>
        </slice>
        <from usec="0" sec="1230786001"/>
        <to usec="0" sec="1230786469"/>
    </anomaly>
    <anomaly type="anomalous" value="1.111990,0.980186,999,1 1 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="192.231.22.193" src_port="57228"/>
        </slice>
        <from usec="0" sec="1230786181"/>
        <to usec="0" sec="1230786774"/>
    </anomaly>
    <anomaly type="anomalous" value="1.111990,0.980186,999,1 1 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="13.233.99.58" dst_port="25"/>
        </slice>
        <from usec="0" sec="1230786226"/>
        <to usec="0" sec="1230786272"/>
    </anomaly>
    <anomaly type="anomalous" value="1.273170,1.182240,503,1 1 1 1 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="154.101.230.157" dst_port="80"/>
        </slice>
        <from usec="0" sec="1230786705"/>
        <to usec="0" sec="1230786809"/>
    </anomaly>
    <anomaly type="anomalous" value="1.633020,1.451200,503,1 1 0 1 1 1 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="192.231.16.116" dst_ip="212.96.170.249"/>
            <filter src_ip="192.231.16.116" src_port="80"/>
            <filter src_ip="192.231.16.117" src_port="80"/>
            <filter dst_ip="212.96.170.249" src_port="80"/>
        </slice>
        <from usec="0" sec="1230786001"/>
        <to usec="0" sec="1230786829"/>
    </anomaly>
    <anomaly type="anomalous" value="1.558630,1.427090,503,0 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="164.114.6.115" dst_ip="209.43.104.232" src_port="80"/>
        </slice>
        <from usec="0" sec="1230786309"/>
        <to usec="0" sec="1230786648"/>
    </anomaly>
    <anomaly type="anomalous" value="1.978370,1.684910,010,1 1 1 1 1 1 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="83.20.168.120" dst_port="80"/>
        </slice>
        <from usec="0" sec="1230786676"/>
        <to usec="0" sec="1230786900"/>
    </anomaly>
    <anomaly type="anomalous" value="1.273170,1.182240,503,1 1 1 1 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="58.162.0.146" dst_ip="154.101.230.167" dst_port="80"/>
        </slice>
        <from usec="0" sec="1230786009"/>
        <to usec="0" sec="1230786829"/>
    </anomaly>
    <anomaly type="anomalous" value="1.402540,1.165460,503,1 1 0 1 1 0 1 1 1 0 0 0,ntscACK">
        <slice>
            <filter src_ip="192.231.22.252" src_port="80"/>
        </slice>
        <from usec="0" sec="1230786181"/>
        <to usec="0" sec="1230786798"/>
    </anomaly>
    <anomaly type="anomalous" value="1.558630,1.427090,503,0 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="160.48.167.250" dst_ip="3.151.141.246" src_port="80"/>
        </slice>
        <from usec="0" sec="1230786773"/>
        <to usec="0" sec="1230786790"/>
    </anomaly>
    <anomaly type="anomalous" value="1.558630,1.427090,503,0 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="160.38.89.36" dst_ip="49.100.30.34" src_port="80"/>
        </slice>
        <from usec="0" sec="1230786001"/>
        <to usec="0" sec="1230786829"/>
    </anomaly>
    <anomaly type="anomalous" value="1.558630,1.427090,503,0 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="160.48.44.138" dst_ip="219.12.207.8" src_port="80"/>
        </slice>
        <from usec="0" sec="1230786001"/>
        <to usec="0" sec="1230786739"/>
    </anomaly>
    <anomaly type="anomalous" value="1.558630,1.427090,503,0 0 0 1 1 1 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="160.48.135.104" dst_ip="218.161.225.243" src_port="80" dst_port="10524"/>
            <filter src_ip="160.48.135.104" dst_ip="218.161.225.243" src_port="80" dst_port="10449"/>
            <filter src_ip="160.48.196.47" dst_ip="218.161.225.243" src_port="80" dst_port="10541"/>
        </slice>
        <from usec="0" sec="1230786169"/>
        <to usec="0" sec="1230786208"/>
    </anomaly>
    <anomaly type="anomalous" value="1.558630,1.427090,503,0 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="160.38.8.162" dst_ip="49.100.30.77" src_port="80"/>
        </slice>
        <from usec="0" sec="1230786001"/>
        <to usec="0" sec="1230786829"/>
    </anomaly>
    <anomaly type="anomalous" value="1.558630,1.427090,503,0 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="164.114.4.16" dst_ip="41.242.1.253" src_port="80"/>
        </slice>
        <from usec="0" sec="1230786008"/>
        <to usec="0" sec="1230786559"/>
    </anomaly>
    <anomaly type="anomalous" value="1.558630,1.427090,503,0 0 0 1 1 1 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="164.114.212.157" dst_ip="9.119.179.165"/>
            <filter src_ip="164.114.212.157" dst_ip="210.114.43.8" src_port="80"/>
            <filter src_ip="164.114.4.16" dst_ip="9.119.179.165" src_port="80"/>
        </slice>
        <from usec="0" sec="1230786042"/>
        <to usec="0" sec="1230786558"/>
    </anomaly>
    <anomaly type="anomalous" value="1.558630,1.427090,503,0 0 0 1 1 1 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="160.38.182.231" dst_ip="49.100.16.32" src_port="80"/>
            <filter src_ip="165.66.36.72" dst_ip="49.100.16.32" src_port="80"/>
        </slice>
        <from usec="0" sec="1230786006"/>
        <to usec="0" sec="1230786649"/>
    </anomaly>
    <anomaly type="anomalous" value="1.435460,1.238290,503,1 1 1 1 0 0 1 1 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="192.231.22.252" dst_port="80"/>
        </slice>
        <from usec="0" sec="1230786001"/>
        <to usec="0" sec="1230786798"/>
    </anomaly>
    <anomaly type="anomalous" value="1.521530,1.288710,503,1 1 1 0 0 0 1 1 1 0 0 0,ntscACK">
        <slice>
            <filter src_ip="164.114.1.166" dst_port="80"/>
        </slice>
        <from usec="0" sec="1230786151"/>
        <to usec="0" sec="1230786897"/>
    </anomaly>
    <anomaly type="anomalous" value="1.521530,1.288710,020,1 1 1 0 0 0 1 1 1 0 0 0,ntscICec">
        <slice>
            <filter src_ip="214.225.255.5"/>
        </slice>
        <from usec="0" sec="1230786001"/>
        <to usec="0" sec="1230786282"/>
    </anomaly>
    <anomaly type="anomalous" value="0.999545,0.944116,999,0 0 0 0 0 0 1 1 1 0 0 0,mptpla">
        <slice>
            <filter dst_ip="209.94.80.6"/>
        </slice>
        <from usec="0" sec="1230786001"/>
        <to usec="0" sec="1230786047"/>
    </anomaly>
    <anomaly type="anomalous" value="1.042700,0.959861,999,0 0 0 1 0 0 1 1 1 0 0 0,ptmpla">
        <slice>
            <filter src_ip="193.235.158.207" dst_ip="10.64.169.8" src_port="53"/>
            <filter src_ip="193.235.158.207" dst_ip="10.64.169.9" src_port="53"/>
        </slice>
        <from usec="0" sec="1230786003"/>
        <to usec="0" sec="1230786558"/>
    </anomaly>
    <anomaly type="anomalous" value="0.999545,0.944116,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="202.50.40.17" src_port="6667"/>
        </slice>
        <from usec="0" sec="1230786181"/>
        <to usec="0" sec="1230786227"/>
    </anomaly>
    <anomaly type="anomalous" value="0.999545,0.944116,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="160.48.137.147" src_port="49763"/>
        </slice>
        <from usec="0" sec="1230786181"/>
        <to usec="0" sec="1230786227"/>
    </anomaly>
    <anomaly type="anomalous" value="0.999545,0.944116,020,0 0 0 0 0 0 1 1 1 0 0 0,ntscICec">
        <slice>
            <filter src_ip="85.173.159.58"/>
        </slice>
        <from usec="0" sec="1230786181"/>
        <to usec="0" sec="1230786227"/>
    </anomaly>
    <anomaly type="anomalous" value="0.999545,0.944116,010,0 0 0 0 0 0 1 1 1 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="208.107.9.174"/>
        </slice>
        <from usec="0" sec="1230786181"/>
        <to usec="0" sec="1230786227"/>
    </anomaly>
    <anomaly type="anomalous" value="0.999545,0.944116,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="192.231.25.81" dst_port="53"/>
            <filter src_ip="192.231.25.81" dst_port="25"/>
        </slice>
        <from usec="0" sec="1230786181"/>
        <to usec="0" sec="1230786227"/>
    </anomaly>
    <anomaly type="anomalous" value="0.999545,0.944116,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="164.114.188.169" src_port="53"/>
            <filter src_ip="164.114.188.169" dst_port="53"/>
        </slice>
        <from usec="0" sec="1230786181"/>
        <to usec="0" sec="1230786227"/>
    </anomaly>
    <anomaly type="anomalous" value="0.999545,0.944116,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmpla">
        <slice>
            <filter src_ip="193.26.145.121" dst_ip="216.226.61.134" dst_port="53"/>
            <filter src_ip="193.26.145.121" dst_ip="217.0.239.94" dst_port="53"/>
            <filter src_ip="193.26.145.121" dst_ip="217.0.238.21" dst_port="53"/>
            <filter src_ip="193.26.145.121" dst_ip="216.226.61.133" dst_port="53"/>
        </slice>
        <from usec="0" sec="1230786181"/>
        <to usec="0" sec="1230786227"/>
    </anomaly>
    <anomaly type="anomalous" value="0.999545,0.944116,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="202.50.40.20" src_port="6667"/>
        </slice>
        <from usec="0" sec="1230786181"/>
        <to usec="0" sec="1230786227"/>
    </anomaly>
    <anomaly type="anomalous" value="1.042700,0.959861,999,0 0 0 1 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_ip="164.114.16.55" dst_port="53"/>
            <filter src_ip="164.114.73.92" dst_port="53"/>
            <filter dst_ip="53.152.115.60" dst_port="53"/>
        </slice>
        <from usec="0" sec="1230786002"/>
        <to usec="0" sec="1230786469"/>
    </anomaly>
    <anomaly type="anomalous" value="0.999545,0.944116,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="154.101.192.248" dst_port="53"/>
        </slice>
        <from usec="0" sec="1230786181"/>
        <to usec="0" sec="1230786227"/>
    </anomaly>
    <anomaly type="anomalous" value="0.999545,0.944116,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="154.101.193.109" dst_port="53"/>
        </slice>
        <from usec="0" sec="1230786181"/>
        <to usec="0" sec="1230786227"/>
    </anomaly>
    <anomaly type="anomalous" value="1.111990,0.980186,999,1 1 0 0 0 0 1 1 1 0 0 0,ptmpla">
        <slice>
            <filter src_ip="49.222.242.206" dst_ip="152.74.42.106" dst_port="1433"/>
            <filter src_ip="49.222.242.206" dst_ip="152.74.42.99" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1230786181"/>
        <to usec="0" sec="1230786875"/>
    </anomaly>
    <anomaly type="anomalous" value="0.999545,0.944116,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="192.231.24.83" src_port="16881"/>
        </slice>
        <from usec="0" sec="1230786181"/>
        <to usec="0" sec="1230786227"/>
    </anomaly>
    <anomaly type="anomalous" value="0.999545,0.944116,011,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="208.84.187.90" src_port="25511"/>
        </slice>
        <from usec="0" sec="1230786181"/>
        <to usec="0" sec="1230786227"/>
    </anomaly>
    <anomaly type="anomalous" value="2.127790,1.760420,503,1 1 1 1 1 1 1 1 1 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="212.96.170.249" dst_ip="192.231.16.116" dst_port="80"/>
        </slice>
        <from usec="0" sec="1230786001"/>
        <to usec="0" sec="1230786893"/>
    </anomaly>
    <anomaly type="anomalous" value="0.999545,0.944116,010,0 0 0 0 0 0 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="37.35.76.231" src_port="80"/>
        </slice>
        <from usec="0" sec="1230786181"/>
        <to usec="0" sec="1230786227"/>
    </anomaly>
    <anomaly type="anomalous" value="0.999545,0.944116,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="160.48.167.87" src_port="53"/>
            <filter src_ip="160.48.167.87" dst_port="53"/>
        </slice>
        <from usec="0" sec="1230786181"/>
        <to usec="0" sec="1230786227"/>
    </anomaly>
    <anomaly type="anomalous" value="0.999545,0.944116,999,0 0 0 0 0 0 1 1 1 0 0 0,alphfl">
        <slice>
            <filter src_ip="11.194.3.163" dst_ip="154.101.214.128" dst_port="9750"/>
        </slice>
        <from usec="0" sec="1230786001"/>
        <to usec="0" sec="1230786227"/>
    </anomaly>
    <anomaly type="anomalous" value="0.999545,0.944116,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="192.231.26.204" dst_port="53"/>
        </slice>
        <from usec="0" sec="1230786181"/>
        <to usec="0" sec="1230786227"/>
    </anomaly>
    <anomaly type="anomalous" value="0.999545,0.944116,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="160.48.5.147" src_port="53"/>
        </slice>
        <from usec="0" sec="1230786181"/>
        <to usec="0" sec="1230786227"/>
    </anomaly>
    <anomaly type="anomalous" value="0.999545,0.944116,999,0 0 0 0 0 0 1 1 1 0 0 0,mptpla">
        <slice>
            <filter src_ip="217.16.12.182" dst_ip="156.36.33.71" src_port="53"/>
            <filter src_ip="217.16.14.83" dst_ip="156.36.33.71" src_port="53"/>
        </slice>
        <from usec="0" sec="1230786001"/>
        <to usec="0" sec="1230786722"/>
    </anomaly>
    <anomaly type="anomalous" value="0.999545,0.944116,011,0 0 0 0 0 0 1 1 1 0 0 0,ptmpla">
        <slice>
            <filter src_ip="214.200.81.185" dst_ip="152.74.194.31" src_port="81"/>
            <filter src_ip="214.200.81.185" dst_ip="152.74.194.29" src_port="81"/>
            <filter src_ip="214.200.81.185" dst_ip="152.74.194.30" src_port="81"/>
        </slice>
        <from usec="0" sec="1230786181"/>
        <to usec="0" sec="1230786227"/>
    </anomaly>
    <anomaly type="anomalous" value="1.111990,0.980186,502,1 1 0 0 0 0 1 1 1 0 0 0,ptmpla">
        <slice>
            <filter src_ip="212.0.39.84" dst_port="22"/>
        </slice>
        <from usec="0" sec="1230786181"/>
        <to usec="0" sec="1230786780"/>
    </anomaly>
    <anomaly type="anomalous" value="1.550220,1.300290,999,1 1 1 1 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_ip="202.37.219.22" src_port="53"/>
            <filter dst_ip="202.37.219.22" dst_port="53"/>
        </slice>
        <from usec="0" sec="1230786001"/>
        <to usec="0" sec="1230786901"/>
    </anomaly>
    <anomaly type="anomalous" value="0.999545,0.944116,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="208.109.6.36" src_port="2676" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1230786181"/>
        <to usec="0" sec="1230786227"/>
    </anomaly>
    <anomaly type="anomalous" value="1.020240,0.945215,999,1 0 0 0 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_port="8582" dst_port="53"/>
            <filter src_ip="154.101.230.233"/>
        </slice>
        <from usec="0" sec="1230786181"/>
        <to usec="0" sec="1230786857"/>
    </anomaly>
    <anomaly type="anomalous" value="0.999545,0.944116,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="80.90.149.187" src_port="1616" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1230786181"/>
        <to usec="0" sec="1230786227"/>
    </anomaly>
    <anomaly type="anomalous" value="0.999545,0.944116,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="216.93.7.109" src_port="1051" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1230786181"/>
        <to usec="0" sec="1230786227"/>
    </anomaly>
    <anomaly type="anomalous" value="0.999545,0.944116,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="213.71.164.89" src_port="1106" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1230786181"/>
        <to usec="0" sec="1230786227"/>
    </anomaly>
    <anomaly type="anomalous" value="0.999545,0.944116,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="49.64.243.71" src_port="1045" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1230786181"/>
        <to usec="0" sec="1230786227"/>
    </anomaly>
    <anomaly type="anomalous" value="0.999545,0.944116,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="212.100.12.89" src_port="1576" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1230786181"/>
        <to usec="0" sec="1230786227"/>
    </anomaly>
    <anomaly type="anomalous" value="0.999545,0.944116,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="81.157.132.224" src_port="1072" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1230786181"/>
        <to usec="0" sec="1230786227"/>
    </anomaly>
    <anomaly type="anomalous" value="0.999545,0.944116,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="80.85.231.21" src_port="1065" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1230786181"/>
        <to usec="0" sec="1230786227"/>
    </anomaly>
    <anomaly type="anomalous" value="0.999545,0.944116,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="193.152.215.67" src_port="1231" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1230786181"/>
        <to usec="0" sec="1230786227"/>
    </anomaly>
    <anomaly type="anomalous" value="0.999545,0.944116,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="85.181.137.13" src_port="1027" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1230786181"/>
        <to usec="0" sec="1230786227"/>
    </anomaly>
    <anomaly type="anomalous" value="0.999545,0.944116,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="80.71.30.183" src_port="1096" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1230786181"/>
        <to usec="0" sec="1230786227"/>
    </anomaly>
    <anomaly type="anomalous" value="0.999545,0.944116,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="193.156.25.177" src_port="1398" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1230786181"/>
        <to usec="0" sec="1230786227"/>
    </anomaly>
    <anomaly type="anomalous" value="1.062560,0.960943,999,1 0 0 1 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="192.231.21.209" dst_port="3124"/>
        </slice>
        <from usec="0" sec="1230786001"/>
        <to usec="0" sec="1230786829"/>
    </anomaly>
    <anomaly type="suspicious" value="0.674029,0.817123,999,1 1 0 0 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="53.59.184.137" dst_ip="154.101.17.109" src_port="1047" dst_port="1047"/>
            <filter src_ip="48.210.76.227" dst_ip="154.101.17.109" src_port="1060" dst_port="1047"/>
            <filter src_ip="193.93.31.2" dst_ip="154.101.17.109" src_port="1026" dst_port="1047"/>
            <filter src_ip="108.193.126.142" dst_ip="154.101.17.109" src_port="8102" dst_port="1047"/>
            <filter src_ip="23.43.1.183" dst_ip="154.101.17.109" src_port="1047" dst_port="1047"/>
        </slice>
        <from usec="0" sec="1230786261"/>
        <to usec="0" sec="1230786791"/>
    </anomaly>
    <anomaly type="suspicious" value="0.674029,0.817123,503,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="44.230.168.229" dst_ip="154.101.138.40" src_port="80"/>
        </slice>
        <from usec="0" sec="1230786194"/>
        <to usec="0" sec="1230786794"/>
    </anomaly>
    <anomaly type="suspicious" value="0.674029,0.817123,999,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="8.179.101.25" dst_ip="156.36.59.228" dst_port="20"/>
        </slice>
        <from usec="0" sec="1230786708"/>
        <to usec="0" sec="1230786766"/>
    </anomaly>
    <anomaly type="suspicious" value="0.674029,0.817123,999,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="221.0.73.141" dst_ip="156.36.104.95" src_port="45675" dst_port="20"/>
        </slice>
        <from usec="0" sec="1230786207"/>
        <to usec="0" sec="1230786869"/>
    </anomaly>
    <anomaly type="suspicious" value="0.674029,0.817123,999,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="160.48.77.8" dst_ip="213.167.34.72" src_port="993" dst_port="58436"/>
        </slice>
        <from usec="0" sec="1230786242"/>
        <to usec="0" sec="1230786247"/>
    </anomaly>
    <anomaly type="suspicious" value="0.736506,0.835266,999,1 1 0 1 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="192.231.21.209" src_port="3124"/>
            <filter src_ip="192.231.21.209" src_port="3127"/>
            <filter src_ip="192.231.21.209" src_port="3128"/>
        </slice>
        <from usec="0" sec="1230786001"/>
        <to usec="0" sec="1230786894"/>
    </anomaly>
    <anomaly type="suspicious" value="0.674029,0.817123,503,1 1 0 0 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="192.231.26.204" dst_port="53"/>
            <filter src_ip="36.147.214.117" dst_ip="192.231.26.204" dst_port="80"/>
        </slice>
        <from usec="0" sec="1230786206"/>
        <to usec="0" sec="1230786796"/>
    </anomaly>
    <anomaly type="suspicious" value="0.674029,0.817123,999,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="219.93.71.252" dst_ip="164.114.91.22" src_port="6359" dst_port="1389"/>
        </slice>
        <from usec="0" sec="1230786439"/>
        <to usec="0" sec="1230786801"/>
    </anomaly>
    <anomaly type="suspicious" value="0.674029,0.817123,503,1 1 0 0 0 0 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="193.26.137.133" dst_ip="56.165.200.25" dst_port="80"/>
        </slice>
        <from usec="0" sec="1230786231"/>
        <to usec="0" sec="1230786805"/>
    </anomaly>
    <anomaly type="suspicious" value="0.674029,0.817123,999,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="154.101.230.154" dst_ip="193.88.163.70" src_port="20" dst_port="2072"/>
        </slice>
        <from usec="0" sec="1230786384"/>
        <to usec="0" sec="1230786461"/>
    </anomaly>
    <anomaly type="suspicious" value="0.674029,0.817123,503,1 1 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="160.48.99.118" dst_ip="197.123.141.188" dst_port="80"/>
            <filter src_ip="160.48.99.118" dst_ip="214.97.149.35" dst_port="80"/>
        </slice>
        <from usec="0" sec="1230786482"/>
        <to usec="0" sec="1230786895"/>
    </anomaly>
    <anomaly type="suspicious" value="0.674029,0.817123,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="4.39.58.40" dst_ip="192.231.29.168" src_port="33497" dst_port="80"/>
        </slice>
        <from usec="0" sec="1230786798"/>
        <to usec="0" sec="1230786805"/>
    </anomaly>
    <anomaly type="suspicious" value="0.674029,0.817123,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="164.114.204.45" dst_ip="38.30.254.2" dst_port="80"/>
        </slice>
        <from usec="0" sec="1230786236"/>
        <to usec="0" sec="1230786828"/>
    </anomaly>
    <anomaly type="suspicious" value="0.674029,0.817123,999,1 1 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="164.114.66.226" src_port="1039"/>
            <filter src_ip="164.114.66.226" dst_ip="108.193.126.222" dst_port="80"/>
        </slice>
        <from usec="0" sec="1230786151"/>
        <to usec="0" sec="1230786773"/>
    </anomaly>
    <anomaly type="suspicious" value="0.674029,0.817123,999,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="8.68.38.8" dst_ip="164.114.42.49" src_port="44712" dst_port="2364"/>
        </slice>
        <from usec="0" sec="1230786687"/>
        <to usec="0" sec="1230786866"/>
    </anomaly>
    <anomaly type="suspicious" value="0.674029,0.817123,999,1 1 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="160.48.181.76" dst_ip="80.107.228.11" src_port="1008"/>
            <filter src_ip="160.48.181.76" dst_ip="210.140.221.27" dst_port="400"/>
        </slice>
        <from usec="0" sec="1230786151"/>
        <to usec="0" sec="1230786255"/>
    </anomaly>
    <anomaly type="suspicious" value="0.674029,0.817123,999,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="80.107.228.11" dst_ip="160.48.181.76" dst_port="1008"/>
        </slice>
        <from usec="0" sec="1230786406"/>
        <to usec="0" sec="1230786805"/>
    </anomaly>
    <anomaly type="suspicious" value="0.674029,0.817123,502,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="85.137.187.228" dst_ip="164.114.226.221" src_port="1185" dst_port="22"/>
        </slice>
        <from usec="0" sec="1230786203"/>
        <to usec="0" sec="1230786724"/>
    </anomaly>
    <anomaly type="suspicious" value="0.674029,0.817123,999,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="160.131.214.225" dst_ip="193.27.80.25" src_port="4812" dst_port="110"/>
            <filter src_ip="160.131.214.225" dst_ip="193.27.80.25" src_port="4809" dst_port="110"/>
        </slice>
        <from usec="0" sec="1230786516"/>
        <to usec="0" sec="1230786742"/>
    </anomaly>
    <anomaly type="suspicious" value="0.674029,0.817123,999,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="154.101.18.244" dst_ip="56.179.160.111" src_port="2914" dst_port="1935"/>
        </slice>
        <from usec="0" sec="1230786500"/>
        <to usec="0" sec="1230786505"/>
    </anomaly>
    <anomaly type="suspicious" value="0.674029,0.817123,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="154.101.18.228" dst_ip="49.189.150.134" src_port="2085" dst_port="80"/>
        </slice>
        <from usec="0" sec="1230786706"/>
        <to usec="0" sec="1230786805"/>
    </anomaly>
    <anomaly type="suspicious" value="0.674029,0.817123,503,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="57.196.165.62" dst_ip="154.101.135.90" src_port="57741" dst_port="80"/>
        </slice>
        <from usec="0" sec="1230786469"/>
        <to usec="0" sec="1230786474"/>
    </anomaly>
    <anomaly type="suspicious" value="0.674029,0.817123,999,1 1 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="160.48.19.112" dst_ip="215.169.82.130" src_port="2099" dst_port="80"/>
            <filter src_ip="160.48.19.112" dst_ip="82.227.128.242" src_port="2200" dst_port="1935"/>
        </slice>
        <from usec="0" sec="1230786236"/>
        <to usec="0" sec="1230786766"/>
    </anomaly>
    <anomaly type="suspicious" value="0.674029,0.817123,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="57.229.237.21" dst_ip="160.48.44.138" src_port="61990" dst_port="80"/>
            <filter src_ip="57.229.237.21" dst_ip="160.48.44.138" src_port="61899" dst_port="80"/>
        </slice>
        <from usec="0" sec="1230786380"/>
        <to usec="0" sec="1230786780"/>
    </anomaly>
    <anomaly type="suspicious" value="0.674029,0.817123,503,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="154.101.16.2" dst_ip="6.168.193.16" dst_port="80"/>
        </slice>
        <from usec="0" sec="1230786393"/>
        <to usec="0" sec="1230786871"/>
    </anomaly>
    <anomaly type="suspicious" value="0.674029,0.817123,999,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="53.220.48.254" dst_ip="192.231.21.209" src_port="38508" dst_port="8080"/>
        </slice>
        <from usec="0" sec="1230786824"/>
        <to usec="0" sec="1230786828"/>
    </anomaly>
    <anomaly type="suspicious" value="0.674029,0.817123,502,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="84.202.88.65" dst_ip="192.231.25.41" src_port="57870" dst_port="22"/>
        </slice>
        <from usec="0" sec="1230786774"/>
        <to usec="0" sec="1230786787"/>
    </anomaly>
    <anomaly type="suspicious" value="0.674029,0.817123,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="212.19.209.78" dst_ip="154.101.16.2" src_port="80" dst_port="1959"/>
        </slice>
        <from usec="0" sec="1230786663"/>
        <to usec="0" sec="1230786804"/>
    </anomaly>
    <anomaly type="suspicious" value="0.674029,0.817123,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="193.70.2.33" dst_port="445"/>
        </slice>
        <from usec="0" sec="1230786468"/>
        <to usec="0" sec="1230786498"/>
    </anomaly>
    <anomaly type="suspicious" value="0.674029,0.817123,501,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="46.214.201.104" dst_ip="154.101.230.154"/>
        </slice>
        <from usec="0" sec="1230786297"/>
        <to usec="0" sec="1230786461"/>
    </anomaly>
    <anomaly type="suspicious" value="0.674029,0.817123,503,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="187.77.80.85" dst_ip="166.130.93.211" src_port="36826" dst_port="80"/>
        </slice>
        <from usec="0" sec="1230786423"/>
        <to usec="0" sec="1230786428"/>
    </anomaly>
    <anomaly type="suspicious" value="0.674029,0.817123,999,1 1 0 0 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter src_ip="212.29.82.192" dst_ip="160.180.189.160" dst_port="25"/>
            <filter dst_ip="160.180.189.160" src_port="53" dst_port="61188"/>
        </slice>
        <from usec="0" sec="1230786494"/>
        <to usec="0" sec="1230786500"/>
    </anomaly>
    <anomaly type="suspicious" value="0.674029,0.817123,503,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="212.93.150.176" dst_ip="164.114.4.16" dst_port="80"/>
        </slice>
        <from usec="0" sec="1230786406"/>
        <to usec="0" sec="1230786460"/>
    </anomaly>
    <anomaly type="suspicious" value="0.674029,0.817123,999,1 1 0 0 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="193.26.167.135" dst_port="25"/>
        </slice>
        <from usec="0" sec="1230786159"/>
        <to usec="0" sec="1230786886"/>
    </anomaly>
    <anomaly type="suspicious" value="0.674029,0.817123,999,1 1 0 0 0 0 0 0 0 0 0 0,ntscACKt">
        <slice>
            <filter src_ip="192.231.24.66" src_port="46526" dst_port="33000"/>
        </slice>
        <from usec="0" sec="1230786699"/>
        <to usec="0" sec="1230786706"/>
    </anomaly>
    <anomaly type="suspicious" value="0.674029,0.817123,002,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="194.12.206.167" src_port="1030" dst_port="137"/>
        </slice>
        <from usec="0" sec="1230786273"/>
        <to usec="0" sec="1230786290"/>
    </anomaly>
    <anomaly type="suspicious" value="0.674029,0.817123,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="194.12.204.61" dst_port="445"/>
        </slice>
        <from usec="0" sec="1230786151"/>
        <to usec="0" sec="1230786487"/>
    </anomaly>
    <anomaly type="suspicious" value="0.674029,0.817123,999,1 1 0 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="160.48.167.80" dst_port="25"/>
        </slice>
        <from usec="0" sec="1230786375"/>
        <to usec="0" sec="1230786898"/>
    </anomaly>
    <anomaly type="suspicious" value="0.674029,0.817123,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="193.179.136.37" dst_port="445"/>
        </slice>
        <from usec="0" sec="1230786653"/>
        <to usec="0" sec="1230786690"/>
    </anomaly>
    <anomaly type="suspicious" value="0.674029,0.817123,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="208.107.9.174"/>
        </slice>
        <from usec="0" sec="1230786261"/>
        <to usec="0" sec="1230786671"/>
    </anomaly>
    <anomaly type="suspicious" value="0.789306,0.837027,010,1 1 0 0 0 0 1 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="193.172.117.74" dst_port="445"/>
        </slice>
        <from usec="0" sec="1230786541"/>
        <to usec="0" sec="1230786593"/>
    </anomaly>
    <anomaly type="suspicious" value="0.674029,0.817123,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="84.176.84.244" dst_port="445"/>
        </slice>
        <from usec="0" sec="1230786429"/>
        <to usec="0" sec="1230786454"/>
    </anomaly>
    <anomaly type="suspicious" value="0.674029,0.817123,503,1 1 0 0 0 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="49.100.30.15" dst_ip="192.231.25.36" dst_port="80"/>
            <filter src_ip="63.8.115.90" dst_ip="192.231.25.36" dst_port="80"/>
        </slice>
        <from usec="0" sec="1230786691"/>
        <to usec="0" sec="1230786703"/>
    </anomaly>
    <anomaly type="suspicious" value="0.674029,0.817123,503,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="84.225.24.105" dst_ip="164.114.39.197" src_port="1249" dst_port="80"/>
            <filter src_ip="84.225.24.105" dst_ip="164.114.39.197" src_port="1248" dst_port="80"/>
        </slice>
        <from usec="0" sec="1230786740"/>
        <to usec="0" sec="1230786745"/>
    </anomaly>
    <anomaly type="suspicious" value="0.674029,0.817123,999,1 1 0 0 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="160.48.167.80" dst_port="25"/>
        </slice>
        <from usec="0" sec="1230786419"/>
        <to usec="0" sec="1230786664"/>
    </anomaly>
    <anomaly type="suspicious" value="0.552270,0.792628,901,0 0 0 1 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1230786001"/>
        <to usec="0" sec="1230786469"/>
    </anomaly>
    <anomaly type="suspicious" value="0.552270,0.792628,999,0 0 0 1 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="187.77.85.81"/>
        </slice>
        <from usec="0" sec="1230786001"/>
        <to usec="0" sec="1230786108"/>
    </anomaly>
    <anomaly type="suspicious" value="0.552270,0.792628,503,0 0 0 1 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="49.100.16.193"/>
        </slice>
        <from usec="0" sec="1230786006"/>
        <to usec="0" sec="1230786107"/>
    </anomaly>
    <anomaly type="suspicious" value="0.973386,0.997905,020,0 0 0 1 1 0 0 0 0 0 0 0,icmp_error">
        <slice>
            <filter dst_ip="214.225.255.5"/>
        </slice>
        <from usec="0" sec="1230786001"/>
        <to usec="0" sec="1230786280"/>
    </anomaly>
    <anomaly type="suspicious" value="0.552270,0.792628,503,0 0 0 1 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="165.66.39.32"/>
        </slice>
        <from usec="0" sec="1230786002"/>
        <to usec="0" sec="1230786198"/>
    </anomaly>
    <anomaly type="suspicious" value="0.552270,0.792628,999,0 0 0 1 0 0 0 0 0 0 0 0,ipv46tun">
        <slice>
            <filter src_ip="202.209.180.236"/>
        </slice>
        <from usec="0" sec="1230786003"/>
        <to usec="0" sec="1230786195"/>
    </anomaly>
    <anomaly type="suspicious" value="0.552270,0.792628,503,0 0 0 1 0 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="164.114.39.197"/>
        </slice>
        <from usec="0" sec="1230786006"/>
        <to usec="0" sec="1230786199"/>
    </anomaly>
    <anomaly type="suspicious" value="0.552270,0.792628,503,0 0 0 1 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="49.4.136.92"/>
        </slice>
        <from usec="0" sec="1230786013"/>
        <to usec="0" sec="1230786197"/>
    </anomaly>
    <anomaly type="suspicious" value="0.552270,0.792628,503,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="164.114.66.92"/>
        </slice>
        <from usec="0" sec="1230786043"/>
        <to usec="0" sec="1230786128"/>
    </anomaly>
    <anomaly type="suspicious" value="0.552270,0.792628,503,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="84.225.77.80"/>
        </slice>
        <from usec="0" sec="1230786098"/>
        <to usec="0" sec="1230786133"/>
    </anomaly>
    <anomaly type="suspicious" value="0.552270,0.792628,999,0 0 0 1 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="56.179.138.177"/>
        </slice>
        <from usec="0" sec="1230786098"/>
        <to usec="0" sec="1230786131"/>
    </anomaly>
    <anomaly type="suspicious" value="0.552270,0.792628,503,0 0 0 1 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter dst_ip="49.100.30.218"/>
        </slice>
        <from usec="0" sec="1230786154"/>
        <to usec="0" sec="1230786157"/>
    </anomaly>
    <anomaly type="suspicious" value="0.552270,0.792628,503,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="23.21.139.79"/>
        </slice>
        <from usec="0" sec="1230786157"/>
        <to usec="0" sec="1230786162"/>
    </anomaly>
    <anomaly type="suspicious" value="0.552270,0.792628,503,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="55.133.184.162"/>
        </slice>
        <from usec="0" sec="1230786174"/>
        <to usec="0" sec="1230786193"/>
    </anomaly>
    <anomaly type="suspicious" value="0.552270,0.792628,999,0 0 0 1 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="63.186.187.216"/>
        </slice>
        <from usec="0" sec="1230786001"/>
        <to usec="0" sec="1230786198"/>
    </anomaly>
    <anomaly type="suspicious" value="0.552270,0.792628,020,0 0 0 1 0 0 0 0 0 0 0 0,icmp_error">
        <slice>
            <filter src_ip="182.8.1.51"/>
        </slice>
        <from usec="0" sec="1230786001"/>
        <to usec="0" sec="1230786288"/>
    </anomaly>
    <anomaly type="suspicious" value="0.552270,0.792628,503,0 0 0 1 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="62.74.232.84"/>
        </slice>
        <from usec="0" sec="1230786001"/>
        <to usec="0" sec="1230786289"/>
    </anomaly>
    <anomaly type="suspicious" value="0.552270,0.792628,501,0 0 0 1 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="43.23.147.30"/>
        </slice>
        <from usec="0" sec="1230786001"/>
        <to usec="0" sec="1230786289"/>
    </anomaly>
    <anomaly type="suspicious" value="0.552270,0.792628,999,0 0 0 1 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="11.7.34.144"/>
        </slice>
        <from usec="0" sec="1230786059"/>
        <to usec="0" sec="1230786193"/>
    </anomaly>
    <anomaly type="suspicious" value="0.552270,0.792628,503,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="43.244.160.120"/>
        </slice>
        <from usec="0" sec="1230786144"/>
        <to usec="0" sec="1230786151"/>
    </anomaly>
    <anomaly type="suspicious" value="0.552270,0.792628,999,0 0 0 1 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter dst_ip="218.36.43.5"/>
        </slice>
        <from usec="0" sec="1230786275"/>
        <to usec="0" sec="1230786289"/>
    </anomaly>
    <anomaly type="suspicious" value="0.552270,0.792628,503,0 0 0 1 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="187.77.93.46"/>
        </slice>
        <from usec="0" sec="1230786001"/>
        <to usec="0" sec="1230786379"/>
    </anomaly>
    <anomaly type="suspicious" value="0.552270,0.792628,999,0 0 0 1 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="160.38.145.142"/>
        </slice>
        <from usec="0" sec="1230786001"/>
        <to usec="0" sec="1230786460"/>
    </anomaly>
    <anomaly type="suspicious" value="0.552270,0.792628,999,0 0 0 1 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="164.114.212.146"/>
        </slice>
        <from usec="0" sec="1230786061"/>
        <to usec="0" sec="1230786317"/>
    </anomaly>
    <anomaly type="suspicious" value="0.552270,0.792628,999,0 0 0 1 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="192.231.24.67"/>
        </slice>
        <from usec="0" sec="1230786001"/>
        <to usec="0" sec="1230786469"/>
    </anomaly>
    <anomaly type="suspicious" value="0.552270,0.792628,999,0 0 0 1 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="182.8.1.51"/>
        </slice>
        <from usec="0" sec="1230786001"/>
        <to usec="0" sec="1230786468"/>
    </anomaly>
    <anomaly type="suspicious" value="0.552270,0.792628,999,0 0 0 1 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="160.131.2.237"/>
        </slice>
        <from usec="0" sec="1230786001"/>
        <to usec="0" sec="1230786443"/>
    </anomaly>
    <anomaly type="suspicious" value="0.552270,0.792628,999,0 0 0 1 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="192.231.25.59"/>
        </slice>
        <from usec="0" sec="1230786001"/>
        <to usec="0" sec="1230786468"/>
    </anomaly>
    <anomaly type="suspicious" value="0.552270,0.792628,503,0 0 0 1 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="164.114.229.16" src_port="80"/>
            <filter src_ip="164.114.229.16" src_port="1487" dst_port="53"/>
        </slice>
        <from usec="0" sec="1230786002"/>
        <to usec="0" sec="1230786469"/>
    </anomaly>
    <anomaly type="suspicious" value="0.552270,0.792628,020,0 0 0 1 0 0 0 0 0 0 0 0,icmp_error">
        <slice>
            <filter src_ip="182.8.4.65"/>
        </slice>
        <from usec="0" sec="1230786002"/>
        <to usec="0" sec="1230786557"/>
    </anomaly>
    <anomaly type="suspicious" value="0.552270,0.792628,999,0 0 0 1 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="49.85.44.30"/>
        </slice>
        <from usec="0" sec="1230786007"/>
        <to usec="0" sec="1230786466"/>
    </anomaly>
    <anomaly type="suspicious" value="0.552270,0.792628,504,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="7.193.5.26"/>
        </slice>
        <from usec="0" sec="1230786143"/>
        <to usec="0" sec="1230786469"/>
    </anomaly>
    <anomaly type="suspicious" value="0.552270,0.792628,999,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="84.97.170.193"/>
        </slice>
        <from usec="0" sec="1230786187"/>
        <to usec="0" sec="1230786458"/>
    </anomaly>
    <anomaly type="suspicious" value="0.552270,0.792628,503,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="215.57.166.40"/>
        </slice>
        <from usec="0" sec="1230786393"/>
        <to usec="0" sec="1230786398"/>
    </anomaly>
    <anomaly type="suspicious" value="0.552270,0.792628,999,0 0 0 1 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="84.149.196.242"/>
        </slice>
        <from usec="0" sec="1230786002"/>
        <to usec="0" sec="1230786559"/>
    </anomaly>
    <anomaly type="suspicious" value="0.552270,0.792628,503,0 0 0 1 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="160.38.248.28"/>
        </slice>
        <from usec="0" sec="1230786016"/>
        <to usec="0" sec="1230786530"/>
    </anomaly>
    <anomaly type="suspicious" value="0.552270,0.792628,503,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="187.77.224.0"/>
        </slice>
        <from usec="0" sec="1230786030"/>
        <to usec="0" sec="1230786545"/>
    </anomaly>
    <anomaly type="suspicious" value="0.552270,0.792628,503,0 0 0 1 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="160.38.192.25"/>
        </slice>
        <from usec="0" sec="1230786052"/>
        <to usec="0" sec="1230786530"/>
    </anomaly>
    <anomaly type="suspicious" value="0.552270,0.792628,999,0 0 0 1 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="52.33.152.144"/>
        </slice>
        <from usec="0" sec="1230786011"/>
        <to usec="0" sec="1230786642"/>
    </anomaly>
    <anomaly type="suspicious" value="0.552270,0.792628,503,0 0 0 1 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="164.114.12.224"/>
        </slice>
        <from usec="0" sec="1230786036"/>
        <to usec="0" sec="1230786610"/>
    </anomaly>
    <anomaly type="suspicious" value="0.552270,0.792628,503,0 0 0 1 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="150.11.163.146"/>
        </slice>
        <from usec="0" sec="1230786205"/>
        <to usec="0" sec="1230786682"/>
    </anomaly>
    <anomaly type="suspicious" value="0.552270,0.792628,999,0 0 0 1 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="154.101.106.128"/>
        </slice>
        <from usec="0" sec="1230786001"/>
        <to usec="0" sec="1230786732"/>
    </anomaly>
    <anomaly type="suspicious" value="0.552270,0.792628,999,0 0 0 1 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="187.77.232.93"/>
        </slice>
        <from usec="0" sec="1230786001"/>
        <to usec="0" sec="1230786718"/>
    </anomaly>
    <anomaly type="suspicious" value="0.552270,0.792628,999,0 0 0 1 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="160.48.73.5" src_port="53"/>
            <filter src_ip="160.48.73.5" src_port="59850" dst_port="53"/>
        </slice>
        <from usec="0" sec="1230786002"/>
        <to usec="0" sec="1230786726"/>
    </anomaly>
    <anomaly type="suspicious" value="0.552270,0.792628,999,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="60.99.59.48"/>
        </slice>
        <from usec="0" sec="1230786007"/>
        <to usec="0" sec="1230786739"/>
    </anomaly>
    <anomaly type="suspicious" value="0.552270,0.792628,503,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="53.132.17.2"/>
        </slice>
        <from usec="0" sec="1230786017"/>
        <to usec="0" sec="1230786702"/>
    </anomaly>
    <anomaly type="suspicious" value="0.552270,0.792628,503,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="160.38.217.186"/>
        </slice>
        <from usec="0" sec="1230786682"/>
        <to usec="0" sec="1230786693"/>
    </anomaly>
    <anomaly type="suspicious" value="0.552270,0.792628,502,0 0 0 1 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="35.44.26.106" src_port="22"/>
        </slice>
        <from usec="0" sec="1230786001"/>
        <to usec="0" sec="1230786829"/>
    </anomaly>
    <anomaly type="suspicious" value="0.552270,0.792628,504,0 0 0 1 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="42.216.147.100" dst_ip="156.36.56.168" src_port="443"/>
        </slice>
        <from usec="0" sec="1230786001"/>
        <to usec="0" sec="1230786816"/>
    </anomaly>
    <anomaly type="suspicious" value="0.552270,0.792628,999,0 0 0 1 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="193.154.136.191"/>
        </slice>
        <from usec="0" sec="1230786003"/>
        <to usec="0" sec="1230786825"/>
    </anomaly>
    <anomaly type="suspicious" value="0.552270,0.792628,503,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter dst_ip="22.213.180.177"/>
        </slice>
        <from usec="0" sec="1230786480"/>
        <to usec="0" sec="1230786793"/>
    </anomaly>
    <anomaly type="suspicious" value="0.552270,0.792628,999,0 0 0 1 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="198.21.5.65"/>
        </slice>
        <from usec="0" sec="1230786746"/>
        <to usec="0" sec="1230786781"/>
    </anomaly>
    <anomaly type="suspicious" value="0.973386,0.997905,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="197.251.30.65" dst_ip="154.101.99.82" src_port="80" dst_port="48885"/>
            <filter src_ip="197.251.30.65" dst_ip="154.101.99.82" src_port="80" dst_port="45303"/>
            <filter src_ip="197.251.30.65" dst_ip="154.101.99.82" src_port="80" dst_port="39260"/>
            <filter src_ip="197.251.30.65" dst_ip="154.101.99.82" src_port="80" dst_port="34601"/>
        </slice>
        <from usec="0" sec="1230786073"/>
        <to usec="0" sec="1230786093"/>
    </anomaly>
    <anomaly type="suspicious" value="0.973386,0.997905,999,0 0 0 1 1 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="53.53.71.246" dst_ip="156.36.55.213" src_port="5999" dst_port="63490"/>
        </slice>
        <from usec="0" sec="1230786001"/>
        <to usec="0" sec="1230786379"/>
    </anomaly>
    <anomaly type="suspicious" value="0.973386,0.997905,999,0 0 0 1 1 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="192.231.22.158" src_port="53"/>
            <filter src_ip="192.231.22.158" src_port="80"/>
            <filter src_ip="192.231.22.158" dst_port="25"/>
        </slice>
        <from usec="0" sec="1230786001"/>
        <to usec="0" sec="1230786197"/>
    </anomaly>
    <anomaly type="suspicious" value="0.973386,0.997905,999,0 0 0 1 1 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="23.20.3.18" dst_ip="154.101.230.233" src_port="60427" dst_port="8080"/>
        </slice>
        <from usec="0" sec="1230786032"/>
        <to usec="0" sec="1230786087"/>
    </anomaly>
    <anomaly type="suspicious" value="0.973386,0.997905,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="54.84.62.108" dst_ip="192.231.22.252" src_port="3649" dst_port="80"/>
        </slice>
        <from usec="0" sec="1230786205"/>
        <to usec="0" sec="1230786229"/>
    </anomaly>
    <anomaly type="suspicious" value="0.973386,0.997905,999,0 0 0 1 1 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="192.231.1.52" src_port="1682"/>
            <filter src_ip="192.231.1.52" dst_ip="108.193.126.221" dst_port="80"/>
        </slice>
        <from usec="0" sec="1230786001"/>
        <to usec="0" sec="1230786379"/>
    </anomaly>
    <anomaly type="suspicious" value="0.973386,0.997905,503,0 0 0 1 1 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="160.38.196.3" dst_ip="49.100.16.38" src_port="80" dst_port="44137"/>
            <filter src_ip="160.38.196.3" dst_ip="49.100.16.38" src_port="80" dst_port="37582"/>
            <filter src_ip="160.38.196.3" dst_ip="216.62.162.194" src_port="80" dst_port="40644"/>
            <filter src_ip="160.38.196.3" dst_ip="216.62.162.218" src_port="80" dst_port="38578"/>
        </slice>
        <from usec="0" sec="1230786230"/>
        <to usec="0" sec="1230786360"/>
    </anomaly>
    <anomaly type="suspicious" value="0.973386,0.997905,999,0 0 0 1 1 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="49.4.136.28" src_port="5050"/>
        </slice>
        <from usec="0" sec="1230786002"/>
        <to usec="0" sec="1230786734"/>
    </anomaly>
    <anomaly type="suspicious" value="0.973386,0.997905,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="164.114.5.116" dst_ip="48.187.170.14" src_port="80"/>
        </slice>
        <from usec="0" sec="1230786003"/>
        <to usec="0" sec="1230786469"/>
    </anomaly>
    <anomaly type="suspicious" value="0.973386,0.997905,999,0 0 0 1 1 0 0 0 0 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="202.182.89.176" dst_ip="154.101.192.248" src_port="53"/>
        </slice>
        <from usec="0" sec="1230786001"/>
        <to usec="0" sec="1230786547"/>
    </anomaly>
    <anomaly type="suspicious" value="0.973386,0.997905,020,0 0 0 1 1 0 0 0 0 0 0 0,ttl_error">
        <slice>
            <filter src_ip="192.231.24.22"/>
        </slice>
        <from usec="0" sec="1230786001"/>
        <to usec="0" sec="1230786739"/>
    </anomaly>
    <anomaly type="suspicious" value="0.620939,0.794483,020,0 0 0 0 0 0 1 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="85.173.159.58"/>
        </slice>
        <from usec="0" sec="1230786001"/>
        <to usec="0" sec="1230786047"/>
    </anomaly>
    <anomaly type="suspicious" value="0.620939,0.794483,999,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="160.48.137.147"/>
        </slice>
        <from usec="0" sec="1230786001"/>
        <to usec="0" sec="1230786047"/>
    </anomaly>
    <anomaly type="suspicious" value="0.620939,0.794483,999,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="152.74.167.177"/>
        </slice>
        <from usec="0" sec="1230786001"/>
        <to usec="0" sec="1230786047"/>
    </anomaly>
    <anomaly type="suspicious" value="0.620939,0.794483,999,0 0 0 0 0 0 1 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="160.131.245.179"/>
        </slice>
        <from usec="0" sec="1230786001"/>
        <to usec="0" sec="1230786047"/>
    </anomaly>
    <anomaly type="suspicious" value="0.620939,0.794483,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="192.231.8.111"/>
        </slice>
        <from usec="0" sec="1230786001"/>
        <to usec="0" sec="1230786047"/>
    </anomaly>
    <anomaly type="suspicious" value="0.620939,0.794483,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="192.231.16.133" dst_port="53"/>
        </slice>
        <from usec="0" sec="1230786001"/>
        <to usec="0" sec="1230786047"/>
    </anomaly>
    <anomaly type="suspicious" value="0.620939,0.794483,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="182.8.56.66"/>
        </slice>
        <from usec="0" sec="1230786316"/>
        <to usec="0" sec="1230786362"/>
    </anomaly>
    <anomaly type="suspicious" value="0.620939,0.794483,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="160.180.227.135"/>
        </slice>
        <from usec="0" sec="1230786316"/>
        <to usec="0" sec="1230786362"/>
    </anomaly>
    <anomaly type="suspicious" value="0.620939,0.794483,010,0 0 0 0 0 0 1 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="37.35.76.231"/>
        </slice>
        <from usec="0" sec="1230786676"/>
        <to usec="0" sec="1230786722"/>
    </anomaly>
    <anomaly type="suspicious" value="0.620939,0.794483,011,0 0 0 0 0 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="3.7.29.194"/>
        </slice>
        <from usec="0" sec="1230786676"/>
        <to usec="0" sec="1230786722"/>
    </anomaly>
    <anomaly type="suspicious" value="0.620939,0.794483,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="164.114.46.229" dst_port="53"/>
        </slice>
        <from usec="0" sec="1230786676"/>
        <to usec="0" sec="1230786722"/>
    </anomaly>
    <anomaly type="suspicious" value="0.620939,0.794483,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="192.231.25.81" dst_port="53"/>
        </slice>
        <from usec="0" sec="1230786676"/>
        <to usec="0" sec="1230786722"/>
    </anomaly>
    <anomaly type="suspicious" value="0.620939,0.794483,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="154.101.192.248" dst_port="53"/>
        </slice>
        <from usec="0" sec="1230786811"/>
        <to usec="0" sec="1230786857"/>
    </anomaly>
    <anomaly type="suspicious" value="0.620939,0.794483,503,0 0 0 0 0 0 1 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="154.101.18.205" dst_port="80"/>
        </slice>
        <from usec="0" sec="1230786811"/>
        <to usec="0" sec="1230786857"/>
    </anomaly>
    <anomaly type="suspicious" value="0.862895,0.874033,999,0 0 0 1 0 0 1 1 0 0 0 0,mptmp">
        <slice>
            <filter dst_ip="192.231.21.219"/>
            <filter src_ip="80.188.91.144" dst_ip="154.101.17.68"/>
        </slice>
        <from usec="0" sec="1230786001"/>
        <to usec="0" sec="1230786362"/>
    </anomaly>
    <anomaly type="suspicious" value="0.810223,0.856711,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="160.180.46.22" dst_port="30962"/>
        </slice>
        <from usec="0" sec="1230786001"/>
        <to usec="0" sec="1230786047"/>
    </anomaly>
    <anomaly type="suspicious" value="0.810223,0.856711,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="192.231.28.74" dst_port="53"/>
        </slice>
        <from usec="0" sec="1230786001"/>
        <to usec="0" sec="1230786047"/>
    </anomaly>
    <anomaly type="suspicious" value="0.810223,0.856711,999,0 0 0 0 0 0 1 1 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="217.16.10.255" dst_ip="193.26.136.0" dst_port="53"/>
            <filter src_ip="217.16.10.252" dst_ip="193.26.136.0" dst_port="53"/>
        </slice>
        <from usec="0" sec="1230786001"/>
        <to usec="0" sec="1230786047"/>
    </anomaly>
    <anomaly type="suspicious" value="0.810223,0.856711,503,0 0 0 0 0 0 1 1 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="192.231.16.117" dst_port="80"/>
        </slice>
        <from usec="0" sec="1230786001"/>
        <to usec="0" sec="1230786362"/>
    </anomaly>
    <anomaly type="suspicious" value="0.810223,0.856711,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="160.48.5.147" dst_port="53"/>
        </slice>
        <from usec="0" sec="1230786001"/>
        <to usec="0" sec="1230786047"/>
    </anomaly>
    <anomaly type="suspicious" value="0.810223,0.856711,020,0 0 0 0 0 0 1 1 0 0 0 0,icmp_error">
        <slice>
            <filter src_ip="160.48.160.84"/>
        </slice>
        <from usec="0" sec="1230786181"/>
        <to usec="0" sec="1230786227"/>
    </anomaly>
    <anomaly type="suspicious" value="0.810223,0.856711,503,0 0 0 0 0 0 1 1 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="192.231.26.42" dst_ip="118.245.231.182" dst_port="80"/>
        </slice>
        <from usec="0" sec="1230786181"/>
        <to usec="0" sec="1230786227"/>
    </anomaly>
</admd:annotation>
