<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="anomalous" value="1.756570,1.331120,010,1 1 1 1 1 1 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="221.19.107.171" src_port="6000" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1236056401"/>
        <to usec="0" sec="1236057219"/>
    </anomaly>
    <anomaly type="anomalous" value="1.527770,1.236840,010,1 1 1 1 1 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="13.148.42.118" src_port="6000" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1236057201"/>
        <to usec="0" sec="1236057229"/>
    </anomaly>
    <anomaly type="anomalous" value="1.181330,1.141070,503,1 1 1 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="138.170.61.181" dst_ip="41.133.100.12" dst_port="80"/>
            <filter src_ip="138.170.61.181" dst_ip="212.98.32.148" dst_port="80"/>
        </slice>
        <from usec="0" sec="1236057027"/>
        <to usec="0" sec="1236057031"/>
    </anomaly>
    <anomaly type="anomalous" value="1.181330,1.141070,999,1 1 1 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="35.15.172.73" dst_ip="163.78.199.235" src_port="60224" dst_port="8080"/>
        </slice>
        <from usec="0" sec="1236056567"/>
        <to usec="0" sec="1236056571"/>
    </anomaly>
    <anomaly type="anomalous" value="1.181330,1.141070,503,1 1 1 0 0 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="163.78.108.122" src_port="49367"/>
            <filter src_ip="163.78.108.122" dst_port="80"/>
        </slice>
        <from usec="0" sec="1236056957"/>
        <to usec="0" sec="1236057292"/>
    </anomaly>
    <anomaly type="anomalous" value="1.181330,1.141070,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="221.21.207.254" dst_port="1026"/>
        </slice>
        <from usec="0" sec="1236057295"/>
        <to usec="0" sec="1236057301"/>
    </anomaly>
    <anomaly type="anomalous" value="4.291490,3.718590,010,1 1 1 1 1 1 1 1 1 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="14.185.4.118" src_port="6000" dst_port="4899"/>
        </slice>
        <from usec="0" sec="1236057076"/>
        <to usec="0" sec="1236057275"/>
    </anomaly>
    <anomaly type="anomalous" value="1.232190,1.143140,999,1 1 1 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="195.66.226.158" dst_port="53"/>
        </slice>
        <from usec="0" sec="1236056401"/>
        <to usec="0" sec="1236057177"/>
    </anomaly>
    <anomaly type="anomalous" value="1.181330,1.141070,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="108.129.135.68"/>
        </slice>
        <from usec="0" sec="1236057156"/>
        <to usec="0" sec="1236057160"/>
    </anomaly>
    <anomaly type="anomalous" value="1.181330,1.141070,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="183.138.176.89" dst_port="23"/>
        </slice>
        <from usec="0" sec="1236057027"/>
        <to usec="0" sec="1236057032"/>
    </anomaly>
    <anomaly type="anomalous" value="1.181330,1.141070,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="200.140.13.26" dst_port="23"/>
        </slice>
        <from usec="0" sec="1236056999"/>
        <to usec="0" sec="1236057008"/>
    </anomaly>
    <anomaly type="anomalous" value="1.181330,1.141070,999,1 1 1 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="203.195.94.62" dst_ip="203.238.196.34" src_port="500" dst_port="500"/>
            <filter src_ip="203.195.94.62" dst_ip="203.238.196.34"/>
        </slice>
        <from usec="0" sec="1236056401"/>
        <to usec="0" sec="1236057184"/>
    </anomaly>
    <anomaly type="anomalous" value="1.181330,1.141070,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="4.120.14.203" dst_port="25"/>
        </slice>
        <from usec="0" sec="1236056957"/>
        <to usec="0" sec="1236056973"/>
    </anomaly>
    <anomaly type="anomalous" value="1.198980,1.134530,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="106.160.61.57" src_port="6000" dst_port="8089"/>
        </slice>
        <from usec="0" sec="1236056569"/>
        <to usec="0" sec="1236056762"/>
    </anomaly>
    <anomaly type="anomalous" value="1.181330,1.141070,999,1 1 1 0 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="138.170.196.178" dst_ip="208.51.5.102" dst_port="25"/>
            <filter src_ip="140.10.143.31" dst_ip="208.51.5.102" dst_port="25"/>
        </slice>
        <from usec="0" sec="1236056959"/>
        <to usec="0" sec="1236056968"/>
    </anomaly>
    <anomaly type="anomalous" value="1.768490,1.325510,010,1 1 1 1 1 1 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="108.129.135.68" src_port="6000" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1236057121"/>
        <to usec="0" sec="1236057167"/>
    </anomaly>
    <anomaly type="anomalous" value="1.579190,1.226400,503,1 1 0 1 1 1 1 1 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="203.238.205.118" src_port="80"/>
        </slice>
        <from usec="0" sec="1236056401"/>
        <to usec="0" sec="1236057229"/>
    </anomaly>
    <anomaly type="anomalous" value="1.791170,1.332890,010,1 1 1 1 1 1 1 1 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="108.189.153.7" src_port="6000" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1236056491"/>
        <to usec="0" sec="1236056760"/>
    </anomaly>
    <anomaly type="anomalous" value="1.384430,1.203520,999,0 0 0 1 1 1 0 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="203.238.202.24"/>
        </slice>
        <from usec="0" sec="1236056767"/>
        <to usec="0" sec="1236056948"/>
    </anomaly>
    <anomaly type="anomalous" value="1.406160,1.186880,503,1 0 0 1 1 1 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="140.10.39.183" dst_ip="35.65.120.201" src_port="80"/>
        </slice>
        <from usec="0" sec="1236056401"/>
        <to usec="0" sec="1236057229"/>
    </anomaly>
    <anomaly type="anomalous" value="1.428070,1.205470,503,0 0 0 1 1 1 1 1 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="203.238.205.118" dst_port="80"/>
        </slice>
        <from usec="0" sec="1236056401"/>
        <to usec="0" sec="1236057139"/>
    </anomaly>
    <anomaly type="anomalous" value="1.384430,1.203520,503,0 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="139.122.200.54" dst_ip="35.65.112.203" src_port="80"/>
        </slice>
        <from usec="0" sec="1236056404"/>
        <to usec="0" sec="1236056599"/>
    </anomaly>
    <anomaly type="anomalous" value="1.384430,1.203520,020,0 0 0 1 1 1 0 0 0 0 0 0,icmp_error">
        <slice>
            <filter dst_ip="44.61.145.67"/>
        </slice>
        <from usec="0" sec="1236056401"/>
        <to usec="0" sec="1236056907"/>
    </anomaly>
    <anomaly type="anomalous" value="1.384430,1.203520,503,0 0 0 1 1 1 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="138.170.68.138" dst_ip="152.5.132.192" src_port="80"/>
            <filter src_ip="138.170.68.138" dst_ip="196.236.83.11" src_port="80"/>
        </slice>
        <from usec="0" sec="1236056430"/>
        <to usec="0" sec="1236057015"/>
    </anomaly>
    <anomaly type="anomalous" value="1.384430,1.203520,503,0 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="33.117.145.130" dst_ip="138.170.90.167" src_port="80" dst_port="53417"/>
        </slice>
        <from usec="0" sec="1236056522"/>
        <to usec="0" sec="1236056959"/>
    </anomaly>
    <anomaly type="anomalous" value="1.384430,1.203520,504,0 0 0 1 1 1 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="208.51.16.168" dst_ip="163.78.240.161" src_port="443"/>
            <filter src_ip="35.132.13.124" dst_ip="163.78.240.161" src_port="80"/>
        </slice>
        <from usec="0" sec="1236056438"/>
        <to usec="0" sec="1236057229"/>
    </anomaly>
    <anomaly type="anomalous" value="1.384430,1.203520,503,0 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="33.117.145.147" dst_ip="138.170.90.167" src_port="80" dst_port="49655"/>
        </slice>
        <from usec="0" sec="1236056401"/>
        <to usec="0" sec="1236056509"/>
    </anomaly>
    <anomaly type="anomalous" value="1.384430,1.203520,999,0 0 0 1 1 1 0 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.78.108.122" dst_port="49367"/>
        </slice>
        <from usec="0" sec="1236056401"/>
        <to usec="0" sec="1236057229"/>
    </anomaly>
    <anomaly type="anomalous" value="1.384430,1.203520,999,0 0 0 1 1 1 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="203.238.197.63" dst_ip="208.51.16.161" dst_port="25"/>
        </slice>
        <from usec="0" sec="1236056401"/>
        <to usec="0" sec="1236056595"/>
    </anomaly>
    <anomaly type="anomalous" value="1.384430,1.203520,503,0 0 0 1 1 1 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="138.170.194.10" dst_ip="203.57.30.10" dst_port="80"/>
            <filter src_ip="138.170.194.10" dst_ip="86.91.127.25" dst_port="5354"/>
        </slice>
        <from usec="0" sec="1236056458"/>
        <to usec="0" sec="1236056869"/>
    </anomaly>
    <anomaly type="anomalous" value="1.232190,1.143140,999,1 1 1 0 0 0 1 1 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="195.140.93.29" src_port="53"/>
            <filter dst_ip="195.140.93.29" dst_port="53"/>
        </slice>
        <from usec="0" sec="1236056401"/>
        <to usec="0" sec="1236057212"/>
    </anomaly>
    <anomaly type="anomalous" value="1.449150,1.188860,503,1 0 0 1 1 1 1 1 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="203.238.205.119" src_port="80"/>
        </slice>
        <from usec="0" sec="1236056401"/>
        <to usec="0" sec="1236057229"/>
    </anomaly>
    <anomaly type="anomalous" value="1.791170,1.332890,503,1 1 1 1 1 1 1 1 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="203.238.205.119" dst_port="80"/>
        </slice>
        <from usec="0" sec="1236056401"/>
        <to usec="0" sec="1236057271"/>
    </anomaly>
    <anomaly type="anomalous" value="1.321110,1.152770,010,1 1 1 1 0 0 1 1 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="9.210.64.138" src_port="6000" dst_port="445"/>
        </slice>
        <from usec="0" sec="1236057076"/>
        <to usec="0" sec="1236057122"/>
    </anomaly>
    <anomaly type="suspicious" value="0.825283,1.014650,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="202.82.160.252" dst_ip="203.238.192.178" src_port="8754" dst_port="80"/>
        </slice>
        <from usec="0" sec="1236057048"/>
        <to usec="0" sec="1236057148"/>
    </anomaly>
    <anomaly type="suspicious" value="0.825283,1.014650,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="138.170.161.104" dst_ip="216.138.155.25" src_port="80" dst_port="36953"/>
            <filter src_ip="138.170.161.104" dst_ip="216.138.155.25" src_port="80" dst_port="34734"/>
            <filter src_ip="138.170.161.104" dst_ip="216.138.155.25" src_port="80" dst_port="34364"/>
        </slice>
        <from usec="0" sec="1236057135"/>
        <to usec="0" sec="1236057148"/>
    </anomaly>
    <anomaly type="suspicious" value="0.825283,1.014650,999,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="109.130.140.110" dst_ip="138.170.104.124" src_port="50046" dst_port="63547"/>
        </slice>
        <from usec="0" sec="1236056957"/>
        <to usec="0" sec="1236056973"/>
    </anomaly>
    <anomaly type="suspicious" value="0.825283,1.014650,999,1 1 0 0 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="138.170.198.102" dst_ip="202.39.135.236" src_port="2400" dst_port="110"/>
            <filter src_ip="138.170.218.50" dst_ip="202.39.135.236" src_port="1143" dst_port="110"/>
        </slice>
        <from usec="0" sec="1236057025"/>
        <to usec="0" sec="1236057028"/>
    </anomaly>
    <anomaly type="suspicious" value="0.825283,1.014650,503,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="138.170.177.74" dst_ip="211.47.156.178" dst_port="80"/>
        </slice>
        <from usec="0" sec="1236057137"/>
        <to usec="0" sec="1236057141"/>
    </anomaly>
    <anomaly type="suspicious" value="0.825283,1.014650,999,1 1 0 0 0 0 0 0 0 0 0 0,ipv4gretun">
        <slice>
            <filter src_ip="203.200.126.31" dst_ip="202.38.208.82"/>
        </slice>
        <from usec="0" sec="1236057025"/>
        <to usec="0" sec="1236057296"/>
    </anomaly>
    <anomaly type="suspicious" value="0.825283,1.014650,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPTCPICrp">
        <slice>
            <filter dst_ip="13.148.42.118" src_port="1433" dst_port="6000"/>
            <filter dst_ip="13.148.42.118"/>
        </slice>
        <from usec="0" sec="1236057203"/>
        <to usec="0" sec="1236057206"/>
    </anomaly>
    <anomaly type="suspicious" value="0.825283,1.014650,002,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="193.124.35.185" src_port="1025" dst_port="137"/>
        </slice>
        <from usec="0" sec="1236057132"/>
        <to usec="0" sec="1236057147"/>
    </anomaly>
    <anomaly type="suspicious" value="0.825283,1.014650,002,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="4.116.216.52" src_port="1032" dst_port="137"/>
        </slice>
        <from usec="0" sec="1236057130"/>
        <to usec="0" sec="1236057148"/>
    </anomaly>
    <anomaly type="suspicious" value="0.825283,1.014650,503,1 1 0 0 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="163.78.199.149" dst_port="80"/>
        </slice>
        <from usec="0" sec="1236056957"/>
        <to usec="0" sec="1236057135"/>
    </anomaly>
    <anomaly type="suspicious" value="0.825283,1.014650,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="54.129.216.61" dst_port="445"/>
        </slice>
        <from usec="0" sec="1236057048"/>
        <to usec="0" sec="1236057066"/>
    </anomaly>
    <anomaly type="suspicious" value="0.673569,1.000370,503,0 0 0 1 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter dst_ip="35.65.120.194"/>
        </slice>
        <from usec="0" sec="1236056407"/>
        <to usec="0" sec="1236056508"/>
    </anomaly>
    <anomaly type="suspicious" value="0.673569,1.000370,503,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter dst_ip="202.127.20.55"/>
        </slice>
        <from usec="0" sec="1236056477"/>
        <to usec="0" sec="1236056480"/>
    </anomaly>
    <anomaly type="suspicious" value="0.673569,1.000370,503,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter dst_ip="200.84.25.98"/>
        </slice>
        <from usec="0" sec="1236056401"/>
        <to usec="0" sec="1236056527"/>
    </anomaly>
    <anomaly type="suspicious" value="0.673569,1.000370,999,0 0 0 1 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter dst_ip="38.165.182.238"/>
        </slice>
        <from usec="0" sec="1236056414"/>
        <to usec="0" sec="1236056680"/>
    </anomaly>
    <anomaly type="suspicious" value="0.673569,1.000370,503,0 0 0 1 0 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="212.54.24.39"/>
        </slice>
        <from usec="0" sec="1236056450"/>
        <to usec="0" sec="1236056676"/>
    </anomaly>
    <anomaly type="suspicious" value="0.673569,1.000370,503,0 0 0 1 0 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="208.51.72.25"/>
        </slice>
        <from usec="0" sec="1236056451"/>
        <to usec="0" sec="1236056683"/>
    </anomaly>
    <anomaly type="suspicious" value="0.673569,1.000370,999,0 0 0 1 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter dst_ip="46.207.242.205"/>
        </slice>
        <from usec="0" sec="1236056624"/>
        <to usec="0" sec="1236056640"/>
    </anomaly>
    <anomaly type="suspicious" value="0.673569,1.000370,503,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter dst_ip="203.32.206.38"/>
        </slice>
        <from usec="0" sec="1236056651"/>
        <to usec="0" sec="1236056689"/>
    </anomaly>
    <anomaly type="suspicious" value="0.673569,1.000370,901,0 0 0 1 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1236056401"/>
        <to usec="0" sec="1236056869"/>
    </anomaly>
    <anomaly type="suspicious" value="0.673569,1.000370,901,0 0 0 1 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1236056401"/>
        <to usec="0" sec="1236056869"/>
    </anomaly>
    <anomaly type="suspicious" value="0.673569,1.000370,999,0 0 0 1 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter dst_ip="34.192.1.203"/>
        </slice>
        <from usec="0" sec="1236056401"/>
        <to usec="0" sec="1236056869"/>
    </anomaly>
    <anomaly type="suspicious" value="0.673569,1.000370,503,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter dst_ip="34.4.129.79"/>
        </slice>
        <from usec="0" sec="1236056792"/>
        <to usec="0" sec="1236056810"/>
    </anomaly>
    <anomaly type="suspicious" value="0.673569,1.000370,999,0 0 0 1 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="140.10.142.97" src_port="25"/>
            <filter dst_ip="140.10.142.97" dst_port="25"/>
        </slice>
        <from usec="0" sec="1236056401"/>
        <to usec="0" sec="1236056959"/>
    </anomaly>
    <anomaly type="suspicious" value="0.673569,1.000370,503,0 0 0 1 0 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="140.22.113.164"/>
        </slice>
        <from usec="0" sec="1236056529"/>
        <to usec="0" sec="1236057049"/>
    </anomaly>
    <anomaly type="suspicious" value="0.673569,1.000370,999,0 0 0 1 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="139.103.248.122"/>
        </slice>
        <from usec="0" sec="1236056401"/>
        <to usec="0" sec="1236057049"/>
    </anomaly>
    <anomaly type="suspicious" value="0.673569,1.000370,999,0 0 0 1 0 0 0 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="38.108.11.116"/>
        </slice>
        <from usec="0" sec="1236056410"/>
        <to usec="0" sec="1236057037"/>
    </anomaly>
    <anomaly type="suspicious" value="0.673569,1.000370,503,0 0 0 1 0 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="205.133.156.177"/>
        </slice>
        <from usec="0" sec="1236056917"/>
        <to usec="0" sec="1236057007"/>
    </anomaly>
    <anomaly type="suspicious" value="0.673569,1.000370,503,0 0 0 1 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="138.170.225.104"/>
        </slice>
        <from usec="0" sec="1236056924"/>
        <to usec="0" sec="1236056958"/>
    </anomaly>
    <anomaly type="suspicious" value="0.673569,1.000370,999,0 0 0 1 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter dst_ip="106.234.79.165"/>
        </slice>
        <from usec="0" sec="1236057044"/>
        <to usec="0" sec="1236057049"/>
    </anomaly>
    <anomaly type="suspicious" value="0.673569,1.000370,503,0 0 0 1 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="138.170.241.166"/>
        </slice>
        <from usec="0" sec="1236056968"/>
        <to usec="0" sec="1236057136"/>
    </anomaly>
    <anomaly type="suspicious" value="0.673569,1.000370,503,0 0 0 1 0 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="35.65.112.65"/>
        </slice>
        <from usec="0" sec="1236057057"/>
        <to usec="0" sec="1236057069"/>
    </anomaly>
    <anomaly type="suspicious" value="0.673569,1.000370,503,0 0 0 1 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="140.172.132.198" dst_port="80"/>
            <filter dst_ip="140.172.132.198" dst_port="123"/>
        </slice>
        <from usec="0" sec="1236056401"/>
        <to usec="0" sec="1236057229"/>
    </anomaly>
    <anomaly type="suspicious" value="0.673569,1.000370,503,0 0 0 1 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="140.172.184.207"/>
        </slice>
        <from usec="0" sec="1236057088"/>
        <to usec="0" sec="1236057123"/>
    </anomaly>
    <anomaly type="suspicious" value="0.896565,1.016970,503,1 1 0 0 0 0 1 1 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="203.238.202.99" dst_port="80"/>
        </slice>
        <from usec="0" sec="1236056401"/>
        <to usec="0" sec="1236057135"/>
    </anomaly>
    <anomaly type="suspicious" value="0.704059,0.992894,999,0 0 0 1 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="195.140.93.29" src_port="53"/>
        </slice>
        <from usec="0" sec="1236056460"/>
        <to usec="0" sec="1236057167"/>
    </anomaly>
    <anomaly type="suspicious" value="0.759231,1.002720,999,0 0 0 1 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="203.238.196.89" dst_port="10785"/>
        </slice>
        <from usec="0" sec="1236056401"/>
        <to usec="0" sec="1236056959"/>
    </anomaly>
</admd:annotation>
