<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="anomalous" value="2.024230,1.864140,503,1 0 1 1 1 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="174.111.38.10" dst_port="80"/>
        </slice>
        <from usec="0" sec="1233550800"/>
        <to usec="0" sec="1233551625"/>
    </anomaly>
    <anomaly type="anomalous" value="1.399910,1.342300,504,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="115.141.77.69" dst_ip="136.193.67.128" src_port="16886" dst_port="443"/>
        </slice>
        <from usec="0" sec="1233551341"/>
        <to usec="0" sec="1233551350"/>
    </anomaly>
    <anomaly type="anomalous" value="1.399910,1.342300,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="9.84.177.238" dst_ip="143.34.14.207" src_port="3515" dst_port="80"/>
        </slice>
        <from usec="0" sec="1233551088"/>
        <to usec="0" sec="1233551449"/>
    </anomaly>
    <anomaly type="anomalous" value="1.485240,1.391360,999,1 1 0 1 1 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="136.193.47.105" src_port="1040"/>
            <filter src_ip="136.193.47.105" dst_ip="204.49.12.35" dst_port="80"/>
            <filter src_ip="136.193.47.105" dst_ip="206.73.216.76" dst_port="80"/>
        </slice>
        <from usec="0" sec="1233550800"/>
        <to usec="0" sec="1233551628"/>
    </anomaly>
    <anomaly type="anomalous" value="1.399910,1.342300,504,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="115.141.77.69" dst_ip="136.193.67.128" src_port="16886" dst_port="443"/>
        </slice>
        <from usec="0" sec="1233551341"/>
        <to usec="0" sec="1233551350"/>
    </anomaly>
    <anomaly type="anomalous" value="2.075370,1.895930,010,1 0 1 1 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="209.103.210.68" dst_port="4899"/>
        </slice>
        <from usec="0" sec="1233550806"/>
        <to usec="0" sec="1233551619"/>
    </anomaly>
    <anomaly type="anomalous" value="2.147110,1.935190,010,1 0 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="201.141.77.8" src_port="6000" dst_port="2967"/>
        </slice>
        <from usec="0" sec="1233551295"/>
        <to usec="0" sec="1233551341"/>
    </anomaly>
    <anomaly type="anomalous" value="1.399910,1.342300,999,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="214.104.34.197" dst_ip="136.193.161.74" src_port="18392" dst_port="3909"/>
        </slice>
        <from usec="0" sec="1233551214"/>
        <to usec="0" sec="1233551222"/>
    </anomaly>
    <anomaly type="anomalous" value="1.399910,1.342300,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="136.193.66.152" dst_ip="3.169.86.164" src_port="80" dst_port="2979"/>
        </slice>
        <from usec="0" sec="1233550843"/>
        <to usec="0" sec="1233551311"/>
    </anomaly>
    <anomaly type="anomalous" value="1.485240,1.391360,503,1 1 0 1 1 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="201.106.218.103" src_port="80"/>
        </slice>
        <from usec="0" sec="1233550800"/>
        <to usec="0" sec="1233551619"/>
    </anomaly>
    <anomaly type="anomalous" value="2.249170,2.021250,503,1 1 1 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="218.86.85.185" dst_ip="174.111.161.144" src_port="80" dst_port="4844"/>
        </slice>
        <from usec="0" sec="1233551107"/>
        <to usec="0" sec="1233551121"/>
    </anomaly>
    <anomaly type="anomalous" value="1.399910,1.342300,504,1 1 0 0 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="136.193.193.88" dst_ip="13.134.138.32" src_port="49173" dst_port="443"/>
            <filter src_ip="143.34.127.167" dst_ip="13.134.138.32" src_port="51314" dst_port="443"/>
        </slice>
        <from usec="0" sec="1233550847"/>
        <to usec="0" sec="1233551448"/>
    </anomaly>
    <anomaly type="anomalous" value="3.320270,2.845880,999,1 1 0 1 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_ip="201.106.212.208"/>
            <filter src_ip="201.106.212.219"/>
        </slice>
        <from usec="0" sec="1233550800"/>
        <to usec="0" sec="1233551538"/>
    </anomaly>
    <anomaly type="anomalous" value="1.399910,1.342300,504,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="136.193.88.112" dst_ip="200.43.17.45" dst_port="443"/>
        </slice>
        <from usec="0" sec="1233551077"/>
        <to usec="0" sec="1233551097"/>
    </anomaly>
    <anomaly type="anomalous" value="1.399910,1.342300,020,1 1 0 0 0 0 0 0 0 0 0 0,ptpDoSIC">
        <slice>
            <filter src_ip="201.106.218.189" dst_ip="219.86.190.135"/>
            <filter src_ip="201.106.218.189" dst_ip="20.151.196.236"/>
        </slice>
        <from usec="0" sec="1233550859"/>
        <to usec="0" sec="1233550879"/>
    </anomaly>
    <anomaly type="anomalous" value="1.399910,1.342300,504,1 1 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="48.250.20.224" dst_port="80"/>
            <filter src_ip="48.250.20.224" dst_ip="143.197.186.135" dst_port="443"/>
        </slice>
        <from usec="0" sec="1233551614"/>
        <to usec="0" sec="1233551634"/>
    </anomaly>
    <anomaly type="anomalous" value="2.249170,2.021250,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="210.164.198.54" dst_port="445"/>
            <filter src_ip="210.164.198.54" dst_port="139"/>
        </slice>
        <from usec="0" sec="1233551045"/>
        <to usec="0" sec="1233551100"/>
    </anomaly>
    <anomaly type="anomalous" value="2.987420,2.541360,020,1 1 1 0 0 0 1 1 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="201.141.77.8"/>
        </slice>
        <from usec="0" sec="1233551295"/>
        <to usec="0" sec="1233551341"/>
    </anomaly>
    <anomaly type="anomalous" value="1.399910,1.342300,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="0.5.98.225" dst_port="139"/>
            <filter src_ip="0.5.98.225" dst_port="445"/>
        </slice>
        <from usec="0" sec="1233551311"/>
        <to usec="0" sec="1233551367"/>
    </anomaly>
    <anomaly type="anomalous" value="1.399910,1.342300,002,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="18.224.105.249" src_port="1028" dst_port="137"/>
        </slice>
        <from usec="0" sec="1233550851"/>
        <to usec="0" sec="1233550864"/>
    </anomaly>
    <anomaly type="anomalous" value="1.399910,1.342300,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="182.250.40.230" dst_port="23"/>
        </slice>
        <from usec="0" sec="1233551445"/>
        <to usec="0" sec="1233551453"/>
    </anomaly>
    <anomaly type="anomalous" value="1.399910,1.342300,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="52.20.49.81" dst_port="445"/>
        </slice>
        <from usec="0" sec="1233551205"/>
        <to usec="0" sec="1233551211"/>
    </anomaly>
    <anomaly type="anomalous" value="2.249170,2.021250,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="25.161.181.23" dst_port="445"/>
        </slice>
        <from usec="0" sec="1233551609"/>
        <to usec="0" sec="1233551633"/>
    </anomaly>
    <anomaly type="anomalous" value="1.399910,1.342300,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDPICdurp">
        <slice>
            <filter dst_ip="104.129.107.20"/>
        </slice>
        <from usec="0" sec="1233550874"/>
        <to usec="0" sec="1233550885"/>
    </anomaly>
    <anomaly type="anomalous" value="2.249170,2.021250,503,1 1 1 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="143.34.117.87" dst_ip="221.99.32.231" src_port="63258" dst_port="80"/>
            <filter src_ip="143.34.117.87" dst_ip="218.39.214.212" src_port="60611" dst_port="80"/>
        </slice>
        <from usec="0" sec="1233550849"/>
        <to usec="0" sec="1233550859"/>
    </anomaly>
    <anomaly type="anomalous" value="2.249170,2.021250,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="57.165.198.207" dst_port="25"/>
        </slice>
        <from usec="0" sec="1233550843"/>
        <to usec="0" sec="1233550858"/>
    </anomaly>
    <anomaly type="anomalous" value="2.166420,1.979980,999,0 1 1 0 0 0 0 0 0 0 0 0,ipv4gretun">
        <slice>
            <filter src_ip="201.79.146.108" dst_ip="200.42.134.200"/>
        </slice>
        <from usec="0" sec="1233550871"/>
        <to usec="0" sec="1233550885"/>
    </anomaly>
    <anomaly type="anomalous" value="2.166420,1.979980,010,0 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="209.144.55.73" src_port="6000" dst_port="135"/>
        </slice>
        <from usec="0" sec="1233551357"/>
        <to usec="0" sec="1233551359"/>
    </anomaly>
    <anomaly type="anomalous" value="2.411960,2.118850,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="25.185.86.210" dst_port="23"/>
        </slice>
        <from usec="0" sec="1233551205"/>
        <to usec="0" sec="1233551251"/>
    </anomaly>
    <anomaly type="anomalous" value="2.481420,2.362340,503,0 0 0 1 1 1 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="143.197.92.212" src_port="80"/>
        </slice>
        <from usec="0" sec="1233550800"/>
        <to usec="0" sec="1233551559"/>
    </anomaly>
    <anomaly type="anomalous" value="1.485240,1.391360,503,1 1 0 1 1 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="136.193.193.83" dst_ip="85.94.113.207" dst_port="80"/>
        </slice>
        <from usec="0" sec="1233550800"/>
        <to usec="0" sec="1233551605"/>
    </anomaly>
    <anomaly type="anomalous" value="2.553990,2.397040,503,1 0 0 1 1 1 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="201.106.211.49" src_port="80"/>
        </slice>
        <from usec="0" sec="1233550800"/>
        <to usec="0" sec="1233551626"/>
    </anomaly>
    <anomaly type="anomalous" value="1.485240,1.391360,503,1 1 0 1 1 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="136.193.88.125" dst_port="80"/>
            <filter src_ip="136.193.88.125" dst_ip="200.43.17.45" dst_port="443"/>
        </slice>
        <from usec="0" sec="1233551073"/>
        <to usec="0" sec="1233551613"/>
    </anomaly>
    <anomaly type="anomalous" value="2.481420,2.362340,503,0 0 0 1 1 1 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="143.193.122.4" dst_ip="219.143.97.22" src_port="80"/>
            <filter src_ip="154.221.213.189" dst_ip="4.89.145.66" src_port="80"/>
        </slice>
        <from usec="0" sec="1233550809"/>
        <to usec="0" sec="1233551439"/>
    </anomaly>
    <anomaly type="anomalous" value="1.485240,1.391360,503,1 1 0 1 1 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="201.106.218.103" dst_port="80"/>
            <filter src_ip="26.25.118.28" dst_ip="201.106.218.103" dst_port="21"/>
        </slice>
        <from usec="0" sec="1233550800"/>
        <to usec="0" sec="1233551628"/>
    </anomaly>
    <anomaly type="anomalous" value="2.368190,2.301330,020,0 0 0 1 0 1 0 0 0 0 0 0,mptmp">
        <slice>
            <filter dst_ip="165.72.39.198"/>
            <filter src_ip="143.208.163.252" src_port="80"/>
        </slice>
        <from usec="0" sec="1233550800"/>
        <to usec="0" sec="1233551538"/>
    </anomaly>
    <anomaly type="anomalous" value="1.325630,1.263080,999,1 0 0 1 1 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="195.74.153.129" src_port="53"/>
        </slice>
        <from usec="0" sec="1233550800"/>
        <to usec="0" sec="1233551628"/>
    </anomaly>
    <anomaly type="anomalous" value="2.481420,2.362340,503,0 0 0 1 1 1 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="136.193.190.131" dst_ip="3.215.2.166" dst_port="80"/>
        </slice>
        <from usec="0" sec="1233550800"/>
        <to usec="0" sec="1233551628"/>
    </anomaly>
    <anomaly type="anomalous" value="3.162350,2.733830,999,0 0 0 1 1 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="143.197.1.19" dst_port="61870"/>
        </slice>
        <from usec="0" sec="1233550800"/>
        <to usec="0" sec="1233551623"/>
    </anomaly>
    <anomaly type="anomalous" value="2.180780,1.983700,502,1 1 1 1 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="211.48.214.74" dst_port="22"/>
        </slice>
        <from usec="0" sec="1233551431"/>
        <to usec="0" sec="1233551475"/>
    </anomaly>
    <anomaly type="anomalous" value="3.099520,2.689790,999,1 0 0 1 1 0 0 1 1 0 0 0,mptmp">
        <slice>
            <filter src_ip="200.236.199.1" src_port="53"/>
            <filter dst_ip="195.74.153.133" dst_port="53"/>
            <filter src_port="53" dst_port="53"/>
        </slice>
        <from usec="0" sec="1233550800"/>
        <to usec="0" sec="1233551628"/>
    </anomaly>
    <anomaly type="anomalous" value="3.028350,2.567610,999,1 1 1 1 1 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="195.74.153.129" dst_port="53"/>
        </slice>
        <from usec="0" sec="1233550800"/>
        <to usec="0" sec="1233551634"/>
    </anomaly>
    <anomaly type="anomalous" value="2.481420,2.362340,504,0 0 0 1 1 1 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="219.84.226.117" dst_ip="143.34.127.167"/>
            <filter src_ip="219.84.226.117" dst_ip="174.111.219.184"/>
            <filter src_ip="219.84.226.117" dst_ip="143.34.54.144"/>
            <filter src_ip="219.84.226.117" src_port="443"/>
            <filter src_ip="219.84.226.117" src_port="80"/>
            <filter dst_ip="143.34.127.167" src_port="443"/>
            <filter dst_ip="174.111.219.184" src_port="443"/>
            <filter dst_ip="174.111.219.184" src_port="80"/>
            <filter dst_ip="143.34.54.144" src_port="443"/>
            <filter dst_ip="143.34.54.144" src_port="80"/>
        </slice>
        <from usec="0" sec="1233550800"/>
        <to usec="0" sec="1233551605"/>
    </anomaly>
    <anomaly type="anomalous" value="2.481420,2.362340,503,0 0 0 1 1 1 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="154.221.217.193" dst_ip="4.89.156.35" src_port="80"/>
            <filter src_ip="143.193.49.18" dst_ip="4.89.156.35" src_port="80"/>
        </slice>
        <from usec="0" sec="1233550804"/>
        <to usec="0" sec="1233551627"/>
    </anomaly>
    <anomaly type="anomalous" value="2.121100,1.843700,999,0 0 0 1 1 0 1 1 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="201.106.212.218"/>
        </slice>
        <from usec="0" sec="1233550800"/>
        <to usec="0" sec="1233551627"/>
    </anomaly>
    <anomaly type="anomalous" value="2.481420,2.362340,503,0 0 0 1 1 1 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="154.221.217.202" dst_ip="4.89.152.121" src_port="80"/>
            <filter src_ip="137.117.138.145" dst_ip="4.89.152.121" src_port="443"/>
        </slice>
        <from usec="0" sec="1233550816"/>
        <to usec="0" sec="1233551623"/>
    </anomaly>
    <anomaly type="anomalous" value="1.786360,1.646420,999,0 0 0 1 0 0 0 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="168.93.178.197" dst_port="53"/>
        </slice>
        <from usec="0" sec="1233550800"/>
        <to usec="0" sec="1233551356"/>
    </anomaly>
    <anomaly type="anomalous" value="2.363340,2.194600,010,0 0 0 1 0 0 0 0 1 0 0 0,ptpDoSSYN">
        <slice>
            <filter src_ip="212.9.139.217" dst_ip="201.106.196.33" dst_port="30231"/>
            <filter src_ip="220.167.165.180" dst_ip="201.106.196.33" dst_port="30233"/>
            <filter src_ip="192.180.123.170" dst_ip="201.106.196.33" dst_port="30231"/>
        </slice>
        <from usec="0" sec="1233550800"/>
        <to usec="0" sec="1233550970"/>
    </anomaly>
    <anomaly type="anomalous" value="2.578200,2.317480,010,0 0 0 0 0 0 1 0 1 0 0 0,DDoSSYN">
        <slice>
            <filter dst_ip="201.106.196.33" dst_port="6881"/>
            <filter src_ip="220.167.165.180" dst_ip="201.106.196.33" dst_port="30237"/>
            <filter src_ip="77.11.218.194" dst_ip="201.106.196.33" dst_port="30237"/>
        </slice>
        <from usec="0" sec="1233550800"/>
        <to usec="0" sec="1233551566"/>
    </anomaly>
    <anomaly type="anomalous" value="3.123180,2.709200,999,0 0 0 0 0 0 1 1 1 0 0 0,mptpla">
        <slice>
            <filter src_ip="218.95.61.45" dst_ip="168.93.178.197" src_port="53"/>
            <filter src_ip="218.95.62.130" dst_ip="168.93.178.197" src_port="53"/>
        </slice>
        <from usec="0" sec="1233550800"/>
        <to usec="0" sec="1233551566"/>
    </anomaly>
    <anomaly type="anomalous" value="3.123180,2.709200,999,0 0 0 0 0 0 1 1 1 0 0 0,mptpla">
        <slice>
            <filter src_ip="218.95.61.45" dst_ip="168.93.179.101" src_port="53"/>
            <filter src_ip="218.95.62.130" dst_ip="168.93.179.101" src_port="53"/>
        </slice>
        <from usec="0" sec="1233550800"/>
        <to usec="0" sec="1233551341"/>
    </anomaly>
    <anomaly type="anomalous" value="3.123180,2.709200,004,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="21.222.0.236" src_port="445"/>
            <filter src_ip="201.106.222.35" dst_ip="21.222.0.236" dst_port="1556"/>
        </slice>
        <from usec="0" sec="1233550800"/>
        <to usec="0" sec="1233550846"/>
    </anomaly>
    <anomaly type="anomalous" value="2.062240,1.806970,010,0 0 0 0 0 0 1 1 0 0 0 0,ptpDoSSYN">
        <slice>
            <filter src_ip="220.167.165.180" dst_ip="201.106.196.33" dst_port="30233"/>
        </slice>
        <from usec="0" sec="1233550800"/>
        <to usec="0" sec="1233550846"/>
    </anomaly>
    <anomaly type="anomalous" value="1.869230,1.691480,999,0 0 0 0 0 0 0 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="143.197.1.19" dst_port="61870"/>
        </slice>
        <from usec="0" sec="1233550800"/>
        <to usec="0" sec="1233550846"/>
    </anomaly>
    <anomaly type="anomalous" value="2.062240,1.806970,010,0 0 0 0 0 0 1 1 0 0 0 0,ptpDoSSYN">
        <slice>
            <filter src_ip="192.180.123.170" dst_ip="201.106.196.33" dst_port="30231"/>
            <filter src_ip="212.9.139.217" dst_ip="201.106.196.33" dst_port="30231"/>
        </slice>
        <from usec="0" sec="1233550800"/>
        <to usec="0" sec="1233550846"/>
    </anomaly>
    <anomaly type="anomalous" value="2.062240,1.806970,010,0 0 0 0 0 0 1 1 0 0 0 0,ptpDoSSYN">
        <slice>
            <filter src_ip="77.11.218.194" dst_ip="201.106.196.33" dst_port="30237"/>
            <filter src_ip="220.167.165.180" dst_ip="201.106.196.33" dst_port="30237"/>
        </slice>
        <from usec="0" sec="1233551340"/>
        <to usec="0" sec="1233551386"/>
    </anomaly>
    <anomaly type="suspicious" value="0.867338,1.028220,503,1 0 0 0 0 0 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="201.106.212.209" dst_ip="133.52.201.51" src_port="80" dst_port="34398" proto="tcp"/>
        </slice>
        <from usec="0" sec="1233551448"/>
        <to usec="0" sec="1233551451"/>
    </anomaly>
    <anomaly type="suspicious" value="0.867338,1.028220,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="136.193.67.34" dst_ip="201.69.163.169" src_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1233551217"/>
        <to usec="0" sec="1233551221"/>
    </anomaly>
    <anomaly type="suspicious" value="0.867338,1.028220,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="143.208.21.100" dst_ip="214.61.41.177" src_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1233550929"/>
        <to usec="0" sec="1233550932"/>
    </anomaly>
    <anomaly type="suspicious" value="0.867338,1.028220,999,1 0 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="136.193.230.89"/>
        </slice>
        <from usec="0" sec="1233551617"/>
        <to usec="0" sec="1233551621"/>
    </anomaly>
    <anomaly type="suspicious" value="0.867338,1.028220,999,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="174.111.38.96" dst_ip="216.226.167.85" src_port="18154" dst_port="17367" proto="udp"/>
        </slice>
        <from usec="0" sec="1233551169"/>
        <to usec="0" sec="1233551172"/>
    </anomaly>
    <anomaly type="suspicious" value="0.867338,1.028220,999,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="174.111.103.69" dst_ip="4.138.6.82" src_port="52318" dst_port="1003" proto="tcp"/>
        </slice>
        <from usec="0" sec="1233551217"/>
        <to usec="0" sec="1233551701"/>
    </anomaly>
    <anomaly type="suspicious" value="0.867338,1.028220,503,1 0 0 0 0 0 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="219.154.40.95" dst_ip="136.193.230.194" src_port="80" dst_port="22355" proto="tcp"/>
        </slice>
        <from usec="0" sec="1233551096"/>
        <to usec="0" sec="1233551098"/>
    </anomaly>
    <anomaly type="suspicious" value="0.867338,1.028220,999,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="180.174.25.101" dst_ip="136.193.193.17" src_port="25660" dst_port="1066" proto="tcp"/>
        </slice>
        <from usec="0" sec="1233551311"/>
        <to usec="0" sec="1233551365"/>
    </anomaly>
    <anomaly type="suspicious" value="0.867338,1.028220,999,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="4.216.9.240" dst_ip="174.111.177.244" src_port="8004" dst_port="60457" proto="tcp"/>
        </slice>
        <from usec="0" sec="1233551167"/>
        <to usec="0" sec="1233551201"/>
    </anomaly>
    <anomaly type="suspicious" value="0.867338,1.028220,503,1 0 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="109.51.108.255"/>
        </slice>
        <from usec="0" sec="1233550855"/>
        <to usec="0" sec="1233550859"/>
    </anomaly>
    <anomaly type="suspicious" value="0.867338,1.028220,999,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="174.111.197.133" dst_ip="211.85.5.122" src_port="1053" dst_port="1025" proto="udp"/>
        </slice>
        <from usec="0" sec="1233551214"/>
        <to usec="0" sec="1233551218"/>
    </anomaly>
    <anomaly type="suspicious" value="0.867338,1.028220,999,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="109.241.122.55" dst_ip="200.38.7.63" src_port="15000" dst_port="17662" proto="udp"/>
        </slice>
        <from usec="0" sec="1233550846"/>
        <to usec="0" sec="1233550858"/>
    </anomaly>
    <anomaly type="suspicious" value="0.867338,1.028220,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="136.193.135.170" dst_ip="85.89.118.163" src_port="49471" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1233551617"/>
        <to usec="0" sec="1233551621"/>
    </anomaly>
    <anomaly type="suspicious" value="0.867338,1.028220,999,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="218.50.151.214"/>
        </slice>
        <from usec="0" sec="1233551447"/>
        <to usec="0" sec="1233551451"/>
    </anomaly>
    <anomaly type="suspicious" value="0.867338,1.028220,503,1 0 0 0 0 0 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="165.72.200.153" dst_ip="168.93.178.211" src_port="80" dst_port="63989" proto="tcp"/>
        </slice>
        <from usec="0" sec="1233550853"/>
        <to usec="0" sec="1233550856"/>
    </anomaly>
    <anomaly type="suspicious" value="0.867338,1.028220,503,1 0 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="136.193.43.208"/>
        </slice>
        <from usec="0" sec="1233551043"/>
        <to usec="0" sec="1233551047"/>
    </anomaly>
    <anomaly type="suspicious" value="0.867338,1.028220,503,1 0 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="136.193.55.67"/>
        </slice>
        <from usec="0" sec="1233551220"/>
        <to usec="0" sec="1233551224"/>
    </anomaly>
    <anomaly type="suspicious" value="0.867338,1.028220,503,1 0 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="136.193.70.252"/>
        </slice>
        <from usec="0" sec="1233551620"/>
        <to usec="0" sec="1233551628"/>
    </anomaly>
    <anomaly type="suspicious" value="0.867338,1.028220,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="218.86.85.180" dst_ip="174.111.161.144" src_port="80" dst_port="4839" proto="tcp"/>
        </slice>
        <from usec="0" sec="1233551080"/>
        <to usec="0" sec="1233551084"/>
    </anomaly>
    <anomaly type="suspicious" value="0.867338,1.028220,901,1 0 0 0 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="201.106.211.49" dst_ip="201.106.211.49" proto="tcp"/>
        </slice>
        <from usec="0" sec="1233550921"/>
        <to usec="0" sec="1233551336"/>
    </anomaly>
    <anomaly type="suspicious" value="0.867338,1.028220,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="24.17.86.25" dst_ip="201.106.214.79" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1233551088"/>
        <to usec="0" sec="1233551093"/>
    </anomaly>
    <anomaly type="suspicious" value="0.867338,1.028220,010,1 0 0 0 0 0 0 0 0 0 0 0,ptpDoSSYN">
        <slice>
            <filter src_ip="77.11.218.194" dst_ip="201.106.196.33" dst_port="30237"/>
        </slice>
        <from usec="0" sec="1233551450"/>
        <to usec="0" sec="1233551453"/>
    </anomaly>
    <anomaly type="suspicious" value="0.867338,1.028220,010,1 0 0 0 0 0 0 0 0 0 0 0,ptpDoSSYN">
        <slice>
            <filter src_ip="201.106.222.35" dst_ip="21.222.0.236" dst_port="1556" proto="tcp"/>
        </slice>
        <from usec="0" sec="1233551089"/>
        <to usec="0" sec="1233551160"/>
    </anomaly>
    <anomaly type="suspicious" value="0.867338,1.028220,503,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="174.111.182.160" dst_ip="218.86.87.253" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1233551217"/>
        <to usec="0" sec="1233551220"/>
    </anomaly>
    <anomaly type="suspicious" value="0.867338,1.028220,503,1 0 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="136.193.44.137"/>
        </slice>
        <from usec="0" sec="1233551450"/>
        <to usec="0" sec="1233551454"/>
    </anomaly>
    <anomaly type="suspicious" value="0.867338,1.028220,504,1 0 0 0 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="111.99.242.13"/>
        </slice>
        <from usec="0" sec="1233550849"/>
        <to usec="0" sec="1233550853"/>
    </anomaly>
    <anomaly type="suspicious" value="0.867338,1.028220,020,1 0 0 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="174.111.38.110" proto="icmp"/>
        </slice>
        <from usec="0" sec="1233551094"/>
        <to usec="0" sec="1233551201"/>
    </anomaly>
    <anomaly type="suspicious" value="0.867338,1.028220,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="58.37.40.88" dst_port="139" proto="tcp"/>
        </slice>
        <from usec="0" sec="1233550905"/>
        <to usec="0" sec="1233550925"/>
    </anomaly>
    <anomaly type="suspicious" value="0.867338,1.028220,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="26.56.219.118" dst_port="139" proto="tcp"/>
        </slice>
        <from usec="0" sec="1233550860"/>
        <to usec="0" sec="1233550879"/>
    </anomaly>
    <anomaly type="suspicious" value="0.867338,1.028220,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="202.240.16.144" dst_port="139" proto="tcp"/>
        </slice>
        <from usec="0" sec="1233551658"/>
        <to usec="0" sec="1233551701"/>
    </anomaly>
    <anomaly type="suspicious" value="0.867338,1.028220,503,1 0 0 0 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="109.51.108.255" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1233550846"/>
        <to usec="0" sec="1233550850"/>
    </anomaly>
    <anomaly type="suspicious" value="0.867338,1.028220,504,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="174.111.13.32"/>
        </slice>
        <from usec="0" sec="1233550852"/>
        <to usec="0" sec="1233550856"/>
    </anomaly>
    <anomaly type="suspicious" value="0.867338,1.028220,504,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="144.138.158.161"/>
        </slice>
        <from usec="0" sec="1233551055"/>
        <to usec="0" sec="1233551059"/>
    </anomaly>
    <anomaly type="suspicious" value="0.867338,1.028220,999,1 0 0 0 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="168.93.160.72"/>
        </slice>
        <from usec="0" sec="1233551217"/>
        <to usec="0" sec="1233551220"/>
    </anomaly>
    <anomaly type="suspicious" value="0.867338,1.028220,999,1 0 0 0 0 0 0 0 0 0 0 0,ipv4gretun">
        <slice>
            <filter src_ip="201.79.146.108" dst_ip="200.42.134.200"/>
        </slice>
        <from usec="0" sec="1233550871"/>
        <to usec="0" sec="1233551698"/>
    </anomaly>
    <anomaly type="suspicious" value="0.867338,1.028220,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="209.144.55.73" src_port="6000" dst_port="135"/>
        </slice>
        <from usec="0" sec="1233551357"/>
        <to usec="0" sec="1233551359"/>
    </anomaly>
    <anomaly type="suspicious" value="0.999240,1.091480,999,1 0 0 1 1 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="4.89.156.176" dst_ip="201.106.223.176"/>
            <filter src_ip="4.89.156.176" dst_port="80"/>
            <filter dst_ip="201.106.223.176" dst_port="80"/>
            <filter src_ip="138.125.14.85" dst_ip="201.106.223.176" dst_port="21"/>
        </slice>
        <from usec="0" sec="1233550800"/>
        <to usec="0" sec="1233551628"/>
    </anomaly>
    <anomaly type="suspicious" value="0.670319,0.952277,503,1 0 0 1 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="200.42.134.138" dst_port="80"/>
        </slice>
        <from usec="0" sec="1233550800"/>
        <to usec="0" sec="1233551625"/>
    </anomaly>
    <anomaly type="suspicious" value="0.918016,1.070380,999,0 0 0 1 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="174.111.2.129" dst_port="53"/>
            <filter src_ip="201.106.219.101" dst_port="53"/>
            <filter src_ip="143.208.163.194" dst_port="53"/>
        </slice>
        <from usec="0" sec="1233550800"/>
        <to usec="0" sec="1233551538"/>
    </anomaly>
    <anomaly type="suspicious" value="0.999240,1.091480,503,1 0 0 1 1 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="200.38.10.229" src_port="80"/>
        </slice>
        <from usec="0" sec="1233550831"/>
        <to usec="0" sec="1233550998"/>
    </anomaly>
    <anomaly type="suspicious" value="0.999240,1.091480,503,1 0 0 1 1 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="174.111.38.10" src_port="80"/>
        </slice>
        <from usec="0" sec="1233550800"/>
        <to usec="0" sec="1233551621"/>
    </anomaly>
    <anomaly type="suspicious" value="0.670319,0.952277,501,1 0 0 1 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="6.165.149.106" dst_ip="168.93.164.53" src_port="6665" dst_port="2945"/>
            <filter src_ip="26.191.22.251" dst_ip="168.93.164.53" src_port="7003" dst_port="20"/>
            <filter src_ip="4.10.231.6" dst_ip="168.93.164.53" src_port="5050" dst_port="4082"/>
            <filter src_ip="6.197.97.175" dst_ip="168.93.164.53" src_port="5190" dst_port="2273"/>
            <filter src_ip="26.191.186.163" dst_ip="168.93.164.53" src_port="48364" dst_port="21"/>
        </slice>
        <from usec="0" sec="1233550800"/>
        <to usec="0" sec="1233551628"/>
    </anomaly>
    <anomaly type="suspicious" value="0.795672,1.013010,503,0 0 0 1 1 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter dst_ip="136.193.66.157"/>
            <filter src_ip="207.41.61.173" src_port="80"/>
        </slice>
        <from usec="0" sec="1233550800"/>
        <to usec="0" sec="1233551085"/>
    </anomaly>
    <anomaly type="suspicious" value="1.179790,1.195920,503,0 0 0 1 1 0 1 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="200.38.7.63" src_port="16001"/>
            <filter src_ip="200.38.7.63" dst_port="80"/>
        </slice>
        <from usec="0" sec="1233550800"/>
        <to usec="0" sec="1233551627"/>
    </anomaly>
    <anomaly type="suspicious" value="0.795672,1.013010,503,0 0 0 1 1 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="207.82.28.152" src_port="80"/>
            <filter dst_ip="136.193.193.30" src_port="80"/>
        </slice>
        <from usec="0" sec="1233550800"/>
        <to usec="0" sec="1233551434"/>
    </anomaly>
    <anomaly type="suspicious" value="1.262680,1.279310,503,0 1 0 0 0 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="50.128.107.45" dst_ip="174.111.38.10" dst_port="80"/>
            <filter src_ip="214.42.163.33" dst_ip="174.111.38.10" dst_port="80"/>
        </slice>
        <from usec="0" sec="1233550844"/>
        <to usec="0" sec="1233550850"/>
    </anomaly>
    <anomaly type="suspicious" value="0.795672,1.013010,503,0 0 0 1 1 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="200.38.203.196" src_port="80"/>
        </slice>
        <from usec="0" sec="1233550800"/>
        <to usec="0" sec="1233551445"/>
    </anomaly>
    <anomaly type="suspicious" value="0.795672,1.013010,503,0 0 0 1 1 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="174.111.166.232" dst_port="80"/>
            <filter src_ip="143.208.94.95" dst_port="80"/>
            <filter dst_ip="200.43.94.101" dst_port="80"/>
        </slice>
        <from usec="0" sec="1233550813"/>
        <to usec="0" sec="1233551125"/>
    </anomaly>
    <anomaly type="suspicious" value="0.670319,0.952277,999,1 0 0 1 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="136.193.193.28"/>
        </slice>
        <from usec="0" sec="1233550801"/>
        <to usec="0" sec="1233551447"/>
    </anomaly>
    <anomaly type="suspicious" value="0.670319,0.952277,999,1 0 0 1 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="136.193.193.28"/>
        </slice>
        <from usec="0" sec="1233550801"/>
        <to usec="0" sec="1233551618"/>
    </anomaly>
    <anomaly type="suspicious" value="0.795672,1.013010,503,0 0 0 1 1 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="174.111.103.184" dst_port="80"/>
            <filter src_ip="174.111.196.58" dst_port="80"/>
            <filter dst_ip="196.35.1.159" dst_port="80"/>
        </slice>
        <from usec="0" sec="1233550800"/>
        <to usec="0" sec="1233551257"/>
    </anomaly>
    <anomaly type="suspicious" value="0.999240,1.091480,503,1 0 0 1 1 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="143.34.76.241" dst_ip="221.47.151.225" dst_port="80"/>
            <filter src_ip="143.34.76.241" dst_ip="221.47.151.224" dst_port="80"/>
        </slice>
        <from usec="0" sec="1233550800"/>
        <to usec="0" sec="1233551359"/>
    </anomaly>
    <anomaly type="suspicious" value="0.918016,1.070380,999,0 0 0 1 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="201.106.219.101" src_port="53"/>
            <filter dst_ip="174.111.2.129" src_port="53"/>
        </slice>
        <from usec="0" sec="1233550800"/>
        <to usec="0" sec="1233551268"/>
    </anomaly>
    <anomaly type="suspicious" value="0.795672,1.013010,999,0 0 0 1 1 0 0 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="201.106.223.214" src_port="53"/>
            <filter dst_ip="174.114.138.37" src_port="53"/>
        </slice>
        <from usec="0" sec="1233550800"/>
        <to usec="0" sec="1233551622"/>
    </anomaly>
    <anomaly type="suspicious" value="0.795672,1.013010,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="200.36.193.236" dst_ip="174.111.120.144" src_port="80"/>
        </slice>
        <from usec="0" sec="1233550822"/>
        <to usec="0" sec="1233551182"/>
    </anomaly>
    <anomaly type="suspicious" value="0.999240,1.091480,503,1 0 0 1 1 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="201.106.211.48" src_port="80"/>
        </slice>
        <from usec="0" sec="1233550800"/>
        <to usec="0" sec="1233551624"/>
    </anomaly>
    <anomaly type="suspicious" value="0.795672,1.013010,503,0 0 0 1 1 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="143.193.190.252" dst_ip="4.89.145.240" src_port="80" dst_port="38204"/>
            <filter src_ip="136.193.224.1" dst_ip="4.89.145.240" src_port="80" dst_port="49181"/>
        </slice>
        <from usec="0" sec="1233551219"/>
        <to usec="0" sec="1233551272"/>
    </anomaly>
    <anomaly type="suspicious" value="0.670319,0.952277,503,1 0 0 1 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="136.193.193.28" src_port="80"/>
        </slice>
        <from usec="0" sec="1233550800"/>
        <to usec="0" sec="1233551448"/>
    </anomaly>
    <anomaly type="suspicious" value="0.670319,0.952277,503,1 0 0 1 0 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="2.242.195.241" dst_ip="201.106.211.48" src_port="50901" dst_port="80"/>
            <filter src_ip="4.89.156.152" dst_ip="201.106.211.48" src_port="42963" dst_port="80"/>
        </slice>
        <from usec="0" sec="1233551001"/>
        <to usec="0" sec="1233551364"/>
    </anomaly>
    <anomaly type="suspicious" value="0.670319,0.952277,999,1 0 0 1 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="143.208.95.121" dst_ip="213.0.197.49" src_port="4171" dst_port="80"/>
            <filter src_ip="143.208.95.121" dst_ip="111.111.188.89" src_port="1141" dst_port="1935"/>
        </slice>
        <from usec="0" sec="1233550800"/>
        <to usec="0" sec="1233551448"/>
    </anomaly>
    <anomaly type="suspicious" value="0.670319,0.952277,503,1 0 0 1 0 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="4.89.156.8" dst_ip="174.111.38.43" dst_port="80"/>
            <filter src_ip="14.133.3.76" dst_ip="174.111.38.43" dst_port="80"/>
        </slice>
        <from usec="0" sec="1233550800"/>
        <to usec="0" sec="1233551447"/>
    </anomaly>
    <anomaly type="suspicious" value="1.262680,1.279310,010,0 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="209.103.210.68" dst_port="4899"/>
        </slice>
        <from usec="0" sec="1233551089"/>
        <to usec="0" sec="1233551209"/>
    </anomaly>
    <anomaly type="suspicious" value="0.670319,0.952277,501,1 0 0 1 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="168.93.184.171" dst_port="21"/>
            <filter dst_ip="168.93.184.171" dst_port="20"/>
        </slice>
        <from usec="0" sec="1233550838"/>
        <to usec="0" sec="1233551628"/>
    </anomaly>
    <anomaly type="suspicious" value="0.670319,0.952277,503,1 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="143.34.76.88" dst_ip="3.144.73.20" dst_port="80"/>
        </slice>
        <from usec="0" sec="1233551090"/>
        <to usec="0" sec="1233551359"/>
    </anomaly>
    <anomaly type="suspicious" value="0.670319,0.952277,999,1 0 0 1 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="143.208.95.0" dst_port="9575"/>
            <filter src_ip="143.208.95.0" dst_ip="62.48.168.78" src_port="9575"/>
        </slice>
        <from usec="0" sec="1233551350"/>
        <to usec="0" sec="1233551448"/>
    </anomaly>
    <anomaly type="suspicious" value="0.670319,0.952277,503,1 0 0 1 0 0 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="136.193.240.75" dst_ip="3.250.74.97" dst_port="80"/>
        </slice>
        <from usec="0" sec="1233550800"/>
        <to usec="0" sec="1233551628"/>
    </anomaly>
    <anomaly type="suspicious" value="0.670319,0.952277,503,1 0 0 1 0 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="136.193.161.33" dst_port="80"/>
            <filter dst_ip="13.134.171.219" dst_port="80"/>
        </slice>
        <from usec="0" sec="1233550801"/>
        <to usec="0" sec="1233551628"/>
    </anomaly>
    <anomaly type="suspicious" value="0.670319,0.952277,503,1 0 0 1 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="201.106.214.79" dst_ip="24.17.86.25" src_port="80"/>
        </slice>
        <from usec="0" sec="1233550800"/>
        <to usec="0" sec="1233551628"/>
    </anomaly>
    <anomaly type="suspicious" value="0.670319,0.952277,503,1 0 0 1 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="136.193.88.120" dst_port="80"/>
            <filter src_ip="136.193.88.120" dst_ip="200.43.17.45" dst_port="443"/>
        </slice>
        <from usec="0" sec="1233551220"/>
        <to usec="0" sec="1233551628"/>
    </anomaly>
    <anomaly type="suspicious" value="0.670319,0.952277,503,1 0 0 1 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="24.17.86.25" dst_ip="201.106.214.79" dst_port="80"/>
        </slice>
        <from usec="0" sec="1233551599"/>
        <to usec="0" sec="1233551628"/>
    </anomaly>
    <anomaly type="suspicious" value="0.795672,1.013010,999,0 0 0 1 1 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="201.106.222.82" dst_ip="200.197.31.234" src_port="50658" dst_port="36194"/>
        </slice>
        <from usec="0" sec="1233550800"/>
        <to usec="0" sec="1233550908"/>
    </anomaly>
    <anomaly type="suspicious" value="0.795672,1.013010,999,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="214.178.90.132" dst_ip="144.138.45.150" src_port="36650" dst_port="6262"/>
        </slice>
        <from usec="0" sec="1233550800"/>
        <to usec="0" sec="1233550907"/>
    </anomaly>
    <anomaly type="suspicious" value="0.795672,1.013010,999,0 0 0 1 1 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="209.37.116.39" dst_ip="143.208.37.205" src_port="7551" dst_port="2951"/>
        </slice>
        <from usec="0" sec="1233550800"/>
        <to usec="0" sec="1233550998"/>
    </anomaly>
    <anomaly type="suspicious" value="0.795672,1.013010,503,0 0 0 1 1 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="74.200.73.21" dst_ip="143.34.74.151" src_port="80"/>
            <filter src_ip="12.95.208.223" dst_ip="143.34.74.151" src_port="80"/>
            <filter src_ip="139.149.177.252" dst_ip="143.34.74.151" src_port="80"/>
        </slice>
        <from usec="0" sec="1233550811"/>
        <to usec="0" sec="1233550853"/>
    </anomaly>
    <anomaly type="suspicious" value="0.795672,1.013010,503,0 0 0 1 1 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="218.86.85.138" dst_ip="174.111.182.160" src_port="80" dst_port="3654"/>
        </slice>
        <from usec="0" sec="1233550863"/>
        <to usec="0" sec="1233550874"/>
    </anomaly>
    <anomaly type="suspicious" value="0.795672,1.013010,503,0 0 0 1 1 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="143.208.100.27" dst_ip="200.15.7.60" src_port="80" dst_port="4813"/>
        </slice>
        <from usec="0" sec="1233551540"/>
        <to usec="0" sec="1233551561"/>
    </anomaly>
    <anomaly type="suspicious" value="0.795672,1.013010,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="200.38.4.77" dst_ip="209.41.152.2" dst_port="80"/>
        </slice>
        <from usec="0" sec="1233550899"/>
        <to usec="0" sec="1233550998"/>
    </anomaly>
    <anomaly type="suspicious" value="0.795672,1.013010,503,0 0 0 1 1 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter dst_ip="201.106.211.48" dst_port="80"/>
            <filter dst_ip="201.106.211.49" dst_port="80"/>
        </slice>
        <from usec="0" sec="1233550800"/>
        <to usec="0" sec="1233551476"/>
    </anomaly>
    <anomaly type="suspicious" value="0.795672,1.013010,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="136.193.131.165" dst_ip="195.152.54.1" dst_port="80"/>
        </slice>
        <from usec="0" sec="1233550802"/>
        <to usec="0" sec="1233551268"/>
    </anomaly>
    <anomaly type="suspicious" value="0.795672,1.013010,503,0 0 0 1 1 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="109.133.37.199" dst_ip="143.197.92.212" src_port="80" dst_port="63970"/>
            <filter src_ip="109.133.37.199" dst_ip="143.197.92.212" src_port="80" dst_port="63499"/>
            <filter src_ip="109.133.37.199" dst_ip="143.197.92.212" src_port="80" dst_port="60414"/>
            <filter src_ip="109.133.37.199" dst_ip="143.197.92.212" src_port="80" dst_port="49682"/>
        </slice>
        <from usec="0" sec="1233550808"/>
        <to usec="0" sec="1233551221"/>
    </anomaly>
    <anomaly type="suspicious" value="0.795672,1.013010,503,0 0 0 1 1 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="200.38.203.196" dst_ip="218.90.236.77" dst_port="80"/>
        </slice>
        <from usec="0" sec="1233550810"/>
        <to usec="0" sec="1233551087"/>
    </anomaly>
    <anomaly type="suspicious" value="0.795672,1.013010,999,0 0 0 1 1 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="154.221.97.165" src_port="25"/>
            <filter src_ip="154.221.97.165" dst_ip="4.89.156.124" src_port="80"/>
        </slice>
        <from usec="0" sec="1233550816"/>
        <to usec="0" sec="1233551084"/>
    </anomaly>
    <anomaly type="suspicious" value="0.795672,1.013010,503,0 0 0 1 1 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="143.208.163.23" dst_ip="51.177.64.196" src_port="80"/>
        </slice>
        <from usec="0" sec="1233550875"/>
        <to usec="0" sec="1233551081"/>
    </anomaly>
    <anomaly type="suspicious" value="0.795672,1.013010,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="200.38.17.25" dst_ip="217.168.46.20" dst_port="80"/>
        </slice>
        <from usec="0" sec="1233550800"/>
        <to usec="0" sec="1233551243"/>
    </anomaly>
    <anomaly type="suspicious" value="0.795672,1.013010,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="136.193.193.28" dst_ip="215.175.184.15" dst_port="80"/>
        </slice>
        <from usec="0" sec="1233551113"/>
        <to usec="0" sec="1233551208"/>
    </anomaly>
    <anomaly type="suspicious" value="0.795672,1.013010,999,0 0 0 1 1 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="109.248.213.156" src_port="1047" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1233550800"/>
        <to usec="0" sec="1233551268"/>
    </anomaly>
    <anomaly type="suspicious" value="0.795672,1.013010,503,0 0 0 1 1 0 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="143.208.17.100" dst_ip="218.125.202.183" dst_port="80"/>
        </slice>
        <from usec="0" sec="1233550813"/>
        <to usec="0" sec="1233551265"/>
    </anomaly>
    <anomaly type="suspicious" value="0.795672,1.013010,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="136.193.183.204" dst_ip="111.9.202.249" dst_port="80"/>
        </slice>
        <from usec="0" sec="1233551171"/>
        <to usec="0" sec="1233551187"/>
    </anomaly>
    <anomaly type="suspicious" value="0.795672,1.013010,503,0 0 0 1 1 0 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="5.185.108.221" dst_ip="168.93.166.57" dst_port="80"/>
        </slice>
        <from usec="0" sec="1233550801"/>
        <to usec="0" sec="1233551244"/>
    </anomaly>
    <anomaly type="suspicious" value="0.795672,1.013010,503,0 0 0 1 1 0 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="174.111.143.18" dst_ip="207.82.25.6" dst_port="80"/>
        </slice>
        <from usec="0" sec="1233550815"/>
        <to usec="0" sec="1233551327"/>
    </anomaly>
    <anomaly type="suspicious" value="0.795672,1.013010,503,0 0 0 1 1 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="139.35.241.217" dst_ip="201.106.209.59" src_port="80"/>
            <filter src_ip="211.48.214.74" dst_ip="201.106.209.59" dst_port="22"/>
        </slice>
        <from usec="0" sec="1233550853"/>
        <to usec="0" sec="1233551485"/>
    </anomaly>
    <anomaly type="suspicious" value="0.795672,1.013010,502,0 0 0 1 1 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="5.70.148.97" dst_ip="168.93.179.102" src_port="41785" dst_port="161"/>
            <filter src_ip="5.70.148.97" dst_ip="168.93.179.102" src_port="41777" dst_port="161"/>
            <filter src_ip="5.70.148.97" dst_ip="168.93.179.102" src_port="41773" dst_port="161"/>
            <filter src_ip="5.70.148.97" dst_ip="168.93.140.240" src_port="22" dst_port="3114"/>
        </slice>
        <from usec="0" sec="1233550800"/>
        <to usec="0" sec="1233551408"/>
    </anomaly>
    <anomaly type="suspicious" value="0.795672,1.013010,999,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="136.193.224.92" dst_ip="35.78.179.208" src_port="62207" dst_port="11194"/>
        </slice>
        <from usec="0" sec="1233550804"/>
        <to usec="0" sec="1233551626"/>
    </anomaly>
    <anomaly type="suspicious" value="0.795672,1.013010,999,0 0 0 1 1 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="136.193.47.85" dst_ip="219.143.33.46" dst_port="995"/>
            <filter src_ip="136.193.47.85" dst_ip="219.143.33.44" dst_port="995"/>
        </slice>
        <from usec="0" sec="1233550822"/>
        <to usec="0" sec="1233551425"/>
    </anomaly>
    <anomaly type="suspicious" value="0.795672,1.013010,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="136.193.93.72" dst_ip="214.214.26.119" dst_port="80"/>
        </slice>
        <from usec="0" sec="1233551212"/>
        <to usec="0" sec="1233551411"/>
    </anomaly>
    <anomaly type="suspicious" value="0.795672,1.013010,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="136.193.92.41" dst_ip="105.140.216.238" src_port="80" dst_port="40007"/>
            <filter src_ip="136.193.92.41" dst_ip="105.140.216.238" src_port="80" dst_port="40006"/>
            <filter src_ip="136.193.92.41" dst_ip="105.140.216.238" src_port="80" dst_port="40003"/>
        </slice>
        <from usec="0" sec="1233551255"/>
        <to usec="0" sec="1233551277"/>
    </anomaly>
    <anomaly type="suspicious" value="0.795672,1.013010,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="200.216.169.161" dst_ip="143.208.154.241" src_port="80"/>
        </slice>
        <from usec="0" sec="1233551271"/>
        <to usec="0" sec="1233551316"/>
    </anomaly>
    <anomaly type="suspicious" value="0.795672,1.013010,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="143.193.120.172" dst_ip="4.89.156.226" src_port="80" dst_port="43677"/>
        </slice>
        <from usec="0" sec="1233551371"/>
        <to usec="0" sec="1233551383"/>
    </anomaly>
    <anomaly type="suspicious" value="0.795672,1.013010,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="136.193.135.170" dst_ip="4.41.2.26" src_port="49465" dst_port="80"/>
            <filter src_ip="136.193.135.170" dst_ip="4.41.2.26" src_port="49464" dst_port="80"/>
            <filter src_ip="136.193.135.170" dst_ip="4.41.2.26" src_port="49459" dst_port="80"/>
            <filter src_ip="136.193.135.170" dst_ip="4.41.2.26"/>
        </slice>
        <from usec="0" sec="1233551415"/>
        <to usec="0" sec="1233551448"/>
    </anomaly>
    <anomaly type="suspicious" value="0.795672,1.013010,053,0 0 0 1 1 0 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="213.5.132.20" dst_ip="200.42.189.188" src_port="80"/>
        </slice>
        <from usec="0" sec="1233550800"/>
        <to usec="0" sec="1233551531"/>
    </anomaly>
    <anomaly type="suspicious" value="0.795672,1.013010,504,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="201.152.10.7" dst_ip="174.114.75.210" src_port="46235" dst_port="36141"/>
            <filter src_ip="201.152.10.7" dst_ip="174.114.75.210" src_port="45621" dst_port="36141"/>
            <filter src_ip="201.152.10.7" dst_ip="174.114.75.210" src_port="34249" dst_port="443"/>
        </slice>
        <from usec="0" sec="1233550800"/>
        <to usec="0" sec="1233551538"/>
    </anomaly>
    <anomaly type="suspicious" value="0.795672,1.013010,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="201.24.18.105" dst_ip="200.42.135.32" src_port="80"/>
        </slice>
        <from usec="0" sec="1233550800"/>
        <to usec="0" sec="1233551515"/>
    </anomaly>
    <anomaly type="suspicious" value="0.795672,1.013010,503,0 0 0 1 1 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="136.193.134.29" dst_ip="108.13.69.186" src_port="80"/>
            <filter src_ip="136.193.134.29" dst_ip="52.33.130.177" src_port="80"/>
        </slice>
        <from usec="0" sec="1233550873"/>
        <to usec="0" sec="1233551486"/>
    </anomaly>
    <anomaly type="suspicious" value="0.795672,1.013010,503,0 0 0 1 1 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="143.193.59.224" dst_ip="4.89.156.67" src_port="80"/>
        </slice>
        <from usec="0" sec="1233550803"/>
        <to usec="0" sec="1233551628"/>
    </anomaly>
    <anomaly type="suspicious" value="0.795672,1.013010,020,0 0 0 1 1 0 0 0 0 0 0 0,icmp_error">
        <slice>
            <filter dst_ip="165.72.39.198" dst_port="80"/>
            <filter dst_ip="165.72.39.198"/>
        </slice>
        <from usec="0" sec="1233550800"/>
        <to usec="0" sec="1233551538"/>
    </anomaly>
    <anomaly type="suspicious" value="0.795672,1.013010,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="201.106.214.79" dst_ip="51.136.151.29" src_port="80" dst_port="1672"/>
        </slice>
        <from usec="0" sec="1233551454"/>
        <to usec="0" sec="1233551487"/>
    </anomaly>
    <anomaly type="suspicious" value="0.795672,1.013010,502,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="211.48.214.74" dst_ip="201.106.217.192" dst_port="22"/>
        </slice>
        <from usec="0" sec="1233551456"/>
        <to usec="0" sec="1233551496"/>
    </anomaly>
    <anomaly type="suspicious" value="0.795672,1.013010,503,0 0 0 1 1 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="109.65.6.17" dst_ip="143.34.54.212" src_port="80"/>
        </slice>
        <from usec="0" sec="1233551491"/>
        <to usec="0" sec="1233551613"/>
    </anomaly>
    <anomaly type="suspicious" value="0.795672,1.013010,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="136.193.154.155" dst_ip="88.79.1.150" src_port="1862" dst_port="80"/>
            <filter src_ip="136.193.154.155" dst_ip="88.79.1.150" src_port="1860" dst_port="80"/>
            <filter src_ip="136.193.154.155" dst_ip="88.79.1.150" src_port="1854" dst_port="80"/>
            <filter src_ip="136.193.154.155" dst_ip="88.79.1.150" src_port="1848" dst_port="80"/>
        </slice>
        <from usec="0" sec="1233551540"/>
        <to usec="0" sec="1233551570"/>
    </anomaly>
    <anomaly type="suspicious" value="0.795672,1.013010,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="201.106.214.79" dst_ip="51.38.100.186" src_port="80" dst_port="47581"/>
        </slice>
        <from usec="0" sec="1233551605"/>
        <to usec="0" sec="1233551625"/>
    </anomaly>
    <anomaly type="suspicious" value="1.070370,1.138480,999,0 0 0 0 0 0 1 0 0 0 0 0,ipv46tun">
        <slice>
            <filter src_ip="195.207.251.154"/>
        </slice>
        <from usec="0" sec="1233550800"/>
        <to usec="0" sec="1233550846"/>
    </anomaly>
    <anomaly type="suspicious" value="1.070370,1.138480,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="143.197.84.71"/>
        </slice>
        <from usec="0" sec="1233550800"/>
        <to usec="0" sec="1233550846"/>
    </anomaly>
    <anomaly type="suspicious" value="0.918016,1.070380,999,0 0 0 1 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="200.38.22.216" dst_port="12070"/>
        </slice>
        <from usec="0" sec="1233550800"/>
        <to usec="0" sec="1233551443"/>
    </anomaly>
    <anomaly type="suspicious" value="1.070370,1.138480,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="201.106.211.182" dst_port="53"/>
        </slice>
        <from usec="0" sec="1233550800"/>
        <to usec="0" sec="1233550846"/>
    </anomaly>
    <anomaly type="suspicious" value="1.070370,1.138480,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="174.111.38.96" src_port="18154"/>
        </slice>
        <from usec="0" sec="1233550800"/>
        <to usec="0" sec="1233550846"/>
    </anomaly>
    <anomaly type="suspicious" value="1.070370,1.138480,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="174.111.38.111" src_port="22554"/>
        </slice>
        <from usec="0" sec="1233550800"/>
        <to usec="0" sec="1233550846"/>
    </anomaly>
    <anomaly type="suspicious" value="1.070370,1.138480,999,0 0 0 0 0 0 1 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="144.138.165.114" dst_port="19858"/>
        </slice>
        <from usec="0" sec="1233550800"/>
        <to usec="0" sec="1233550846"/>
    </anomaly>
    <anomaly type="suspicious" value="1.070370,1.138480,999,0 0 0 0 0 0 1 0 0 0 0 0,mptmp">
        <slice>
            <filter dst_port="53"/>
            <filter src_ip="143.208.70.159" src_port="53"/>
        </slice>
        <from usec="0" sec="1233550800"/>
        <to usec="0" sec="1233550846"/>
    </anomaly>
    <anomaly type="suspicious" value="1.070370,1.138480,503,0 0 0 0 0 0 1 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="136.193.224.92" dst_ip="14.160.1.48" dst_port="80"/>
        </slice>
        <from usec="0" sec="1233550800"/>
        <to usec="0" sec="1233550846"/>
    </anomaly>
    <anomaly type="suspicious" value="1.179790,1.195920,999,0 0 0 1 1 0 1 0 0 0 0 0,mptmp">
        <slice>
            <filter dst_ip="201.106.212.209"/>
            <filter dst_ip="201.106.212.208" dst_port="80"/>
            <filter dst_ip="201.106.212.208"/>
        </slice>
        <from usec="0" sec="1233550800"/>
        <to usec="0" sec="1233551178"/>
    </anomaly>
    <anomaly type="suspicious" value="1.070370,1.138480,999,0 0 0 0 0 0 1 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="24.181.148.147"/>
        </slice>
        <from usec="0" sec="1233551025"/>
        <to usec="0" sec="1233551071"/>
    </anomaly>
    <anomaly type="suspicious" value="0.918016,1.070380,999,0 0 0 1 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="174.111.2.129" dst_port="53"/>
        </slice>
        <from usec="0" sec="1233550801"/>
        <to usec="0" sec="1233551536"/>
    </anomaly>
    <anomaly type="suspicious" value="1.070370,1.138480,503,0 0 0 0 0 0 1 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="136.193.241.55" dst_port="80"/>
        </slice>
        <from usec="0" sec="1233551070"/>
        <to usec="0" sec="1233551116"/>
    </anomaly>
    <anomaly type="suspicious" value="1.070370,1.138480,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="200.38.23.123" src_port="22074"/>
        </slice>
        <from usec="0" sec="1233551070"/>
        <to usec="0" sec="1233551116"/>
    </anomaly>
    <anomaly type="suspicious" value="0.918016,1.070380,999,0 0 0 1 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="143.208.163.141" src_port="53"/>
        </slice>
        <from usec="0" sec="1233551066"/>
        <to usec="0" sec="1233551236"/>
    </anomaly>
    <anomaly type="suspicious" value="0.918016,1.070380,999,0 0 0 1 0 0 1 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="143.208.163.141" dst_ip="200.188.173.121"/>
            <filter src_ip="143.208.163.141" dst_port="53"/>
            <filter dst_ip="200.188.173.121" dst_port="53"/>
        </slice>
        <from usec="0" sec="1233550818"/>
        <to usec="0" sec="1233551628"/>
    </anomaly>
    <anomaly type="suspicious" value="1.070370,1.138480,020,0 0 0 0 0 0 1 0 0 0 0 0,icmp_error">
        <slice>
            <filter dst_ip="201.106.219.8"/>
        </slice>
        <from usec="0" sec="1233551295"/>
        <to usec="0" sec="1233551341"/>
    </anomaly>
    <anomaly type="suspicious" value="1.070370,1.138480,020,0 0 0 0 0 0 1 0 0 0 0 0,icmp_error">
        <slice>
            <filter dst_ip="201.106.219.216"/>
        </slice>
        <from usec="0" sec="1233551295"/>
        <to usec="0" sec="1233551341"/>
    </anomaly>
    <anomaly type="suspicious" value="1.070370,1.138480,020,0 0 0 0 0 0 1 0 0 0 0 0,icmp_error">
        <slice>
            <filter dst_ip="201.106.221.79"/>
        </slice>
        <from usec="0" sec="1233551295"/>
        <to usec="0" sec="1233551341"/>
    </anomaly>
    <anomaly type="suspicious" value="1.262680,1.279310,010,0 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="201.141.77.8" src_port="6000" dst_port="2967"/>
        </slice>
        <from usec="0" sec="1233551302"/>
        <to usec="0" sec="1233551315"/>
    </anomaly>
    <anomaly type="suspicious" value="1.070370,1.138480,999,0 0 0 0 0 0 1 0 0 0 0 0,mptmp">
        <slice>
            <filter src_port="8582" dst_port="53"/>
        </slice>
        <from usec="0" sec="1233550800"/>
        <to usec="0" sec="1233551341"/>
    </anomaly>
    <anomaly type="suspicious" value="1.070370,1.138480,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="200.38.22.216" src_port="12070"/>
        </slice>
        <from usec="0" sec="1233550800"/>
        <to usec="0" sec="1233550846"/>
    </anomaly>
    <anomaly type="suspicious" value="1.070370,1.138480,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="174.111.205.51"/>
        </slice>
        <from usec="0" sec="1233551520"/>
        <to usec="0" sec="1233551566"/>
    </anomaly>
    <anomaly type="suspicious" value="1.070370,1.138480,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="143.208.154.1"/>
        </slice>
        <from usec="0" sec="1233551565"/>
        <to usec="0" sec="1233551611"/>
    </anomaly>
    <anomaly type="suspicious" value="0.918016,1.070380,999,0 0 0 1 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="200.38.22.139" src_port="7596"/>
        </slice>
        <from usec="0" sec="1233550800"/>
        <to usec="0" sec="1233551627"/>
    </anomaly>
    <anomaly type="suspicious" value="1.070370,1.138480,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="200.38.22.216" src_port="12070"/>
        </slice>
        <from usec="0" sec="1233551070"/>
        <to usec="0" sec="1233551611"/>
    </anomaly>
    <anomaly type="suspicious" value="0.918016,1.070380,999,0 0 0 1 0 0 1 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="22.209.135.221"/>
            <filter dst_ip="174.114.50.237" dst_port="142"/>
        </slice>
        <from usec="0" sec="1233550832"/>
        <to usec="0" sec="1233551441"/>
    </anomaly>
    <anomaly type="suspicious" value="1.070370,1.138480,010,0 0 0 0 0 0 1 0 0 0 0 0,ptpDoSSYN">
        <slice>
            <filter src_ip="212.9.139.217" dst_ip="201.106.196.33" dst_port="30231"/>
        </slice>
        <from usec="0" sec="1233550800"/>
        <to usec="0" sec="1233550846"/>
    </anomaly>
    <anomaly type="suspicious" value="1.070370,1.138480,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="168.93.178.197" dst_port="53"/>
        </slice>
        <from usec="0" sec="1233550800"/>
        <to usec="0" sec="1233550846"/>
    </anomaly>
    <anomaly type="suspicious" value="1.070370,1.138480,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="195.74.153.133" src_port="53" dst_port="53"/>
            <filter src_ip="195.74.153.129" src_port="53" dst_port="53"/>
        </slice>
        <from usec="0" sec="1233550800"/>
        <to usec="0" sec="1233550846"/>
    </anomaly>
    <anomaly type="suspicious" value="1.070370,1.138480,999,0 0 0 0 0 0 1 0 0 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="218.95.62.130" dst_ip="168.93.178.197" src_port="53"/>
        </slice>
        <from usec="0" sec="1233550800"/>
        <to usec="0" sec="1233550846"/>
    </anomaly>
    <anomaly type="suspicious" value="1.070370,1.138480,999,0 0 0 0 0 0 1 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="218.95.62.130" dst_ip="168.93.178.197" src_port="53"/>
            <filter src_ip="218.95.62.130" dst_ip="168.93.179.101" src_port="53"/>
        </slice>
        <from usec="0" sec="1233550800"/>
        <to usec="0" sec="1233551611"/>
    </anomaly>
    <anomaly type="suspicious" value="1.070370,1.138480,999,0 0 0 0 0 0 1 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="218.95.61.45" dst_ip="168.93.178.197" src_port="53"/>
            <filter src_ip="218.95.62.130" dst_ip="168.93.178.197" src_port="53"/>
        </slice>
        <from usec="0" sec="1233551340"/>
        <to usec="0" sec="1233551386"/>
    </anomaly>
</admd:annotation>
