<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="notice" value="0.535999,0.968949,503,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="4.166.212.34" dst_ip="163.78.199.154" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1236057140"/>
        <to usec="0" sec="1236057147"/>
    </anomaly>
    <anomaly type="notice" value="0.535999,0.968949,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="163.78.199.149" dst_ip="6.12.37.64" src_port="80" dst_port="1153" proto="tcp"/>
        </slice>
        <from usec="0" sec="1236056962"/>
        <to usec="0" sec="1236056966"/>
    </anomaly>
    <anomaly type="notice" value="0.535999,0.968949,503,1 0 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="138.170.90.184" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1236057048"/>
        <to usec="0" sec="1236057052"/>
    </anomaly>
    <anomaly type="notice" value="0.535999,0.968949,999,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="138.170.25.6" dst_ip="210.120.21.114" src_port="1146" dst_port="554" proto="tcp"/>
        </slice>
        <from usec="0" sec="1236057000"/>
        <to usec="0" sec="1236057031"/>
    </anomaly>
    <anomaly type="notice" value="0.535999,0.968949,999,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="106.219.28.248" dst_ip="203.238.195.58" src_port="13866" dst_port="7807" proto="udp"/>
        </slice>
        <from usec="0" sec="1236056959"/>
        <to usec="0" sec="1236056962"/>
    </anomaly>
    <anomaly type="notice" value="0.535999,0.968949,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="35.165.195.177"/>
        </slice>
        <from usec="0" sec="1236056959"/>
        <to usec="0" sec="1236056971"/>
    </anomaly>
    <anomaly type="notice" value="0.535999,0.968949,504,1 0 0 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="138.170.209.91"/>
        </slice>
        <from usec="0" sec="1236056783"/>
        <to usec="0" sec="1236056789"/>
    </anomaly>
    <anomaly type="notice" value="0.535999,0.968949,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="40.67.84.188" dst_ip="202.43.50.93" src_port="80" dst_port="1741" proto="tcp"/>
        </slice>
        <from usec="0" sec="1236056962"/>
        <to usec="0" sec="1236056973"/>
    </anomaly>
    <anomaly type="notice" value="0.535999,0.968949,999,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="138.170.118.11" dst_ip="211.4.241.223" src_port="3533" dst_port="19101" proto="tcp"/>
        </slice>
        <from usec="0" sec="1236056965"/>
        <to usec="0" sec="1236056968"/>
    </anomaly>
    <anomaly type="notice" value="0.535999,0.968949,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="138.170.25.71" dst_ip="58.170.103.137" src_port="34894" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1236057005"/>
        <to usec="0" sec="1236057055"/>
    </anomaly>
    <anomaly type="notice" value="0.535999,0.968949,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="138.170.196.209" dst_ip="216.138.142.218" src_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1236056706"/>
        <to usec="0" sec="1236057031"/>
    </anomaly>
    <anomaly type="notice" value="0.535999,0.968949,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="48.80.160.89" dst_ip="202.38.208.36" src_port="80" dst_port="59591" proto="tcp"/>
        </slice>
        <from usec="0" sec="1236057028"/>
        <to usec="0" sec="1236057031"/>
    </anomaly>
    <anomaly type="notice" value="0.535999,0.968949,999,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="138.170.169.85"/>
        </slice>
        <from usec="0" sec="1236056959"/>
        <to usec="0" sec="1236056962"/>
    </anomaly>
    <anomaly type="notice" value="0.535999,0.968949,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="202.38.209.11" dst_ip="206.179.87.214" src_port="36763" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1236056831"/>
        <to usec="0" sec="1236056834"/>
    </anomaly>
    <anomaly type="notice" value="0.535999,0.968949,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="222.0.162.153"/>
        </slice>
        <from usec="0" sec="1236056933"/>
        <to usec="0" sec="1236056937"/>
    </anomaly>
    <anomaly type="notice" value="0.535999,0.968949,503,1 0 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="138.170.192.161"/>
        </slice>
        <from usec="0" sec="1236056964"/>
        <to usec="0" sec="1236057173"/>
    </anomaly>
    <anomaly type="notice" value="0.535999,0.968949,999,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="208.51.106.103"/>
        </slice>
        <from usec="0" sec="1236056970"/>
        <to usec="0" sec="1236056973"/>
    </anomaly>
    <anomaly type="notice" value="0.535999,0.968949,503,1 0 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="138.170.236.78"/>
        </slice>
        <from usec="0" sec="1236057054"/>
        <to usec="0" sec="1236057063"/>
    </anomaly>
    <anomaly type="notice" value="0.535999,0.968949,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="138.170.45.112" dst_ip="209.122.140.169" src_port="32188" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1236056569"/>
        <to usec="0" sec="1236057141"/>
    </anomaly>
    <anomaly type="notice" value="0.535999,0.968949,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="138.170.61.55" dst_ip="218.128.12.61" src_port="18714" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1236056820"/>
        <to usec="0" sec="1236056824"/>
    </anomaly>
    <anomaly type="notice" value="0.535999,0.968949,999,1 0 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="138.170.150.126"/>
        </slice>
        <from usec="0" sec="1236056961"/>
        <to usec="0" sec="1236057034"/>
    </anomaly>
    <anomaly type="notice" value="0.535999,0.968949,503,1 0 0 0 0 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="163.78.72.151" src_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1236057059"/>
        <to usec="0" sec="1236057065"/>
    </anomaly>
    <anomaly type="notice" value="0.535999,0.968949,503,1 0 0 0 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="208.51.107.223"/>
        </slice>
        <from usec="0" sec="1236056825"/>
        <to usec="0" sec="1236056829"/>
    </anomaly>
    <anomaly type="notice" value="0.535999,0.968949,901,1 0 0 0 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="203.238.205.118" dst_ip="203.238.205.118" proto="tcp"/>
        </slice>
        <from usec="0" sec="1236056772"/>
        <to usec="0" sec="1236057271"/>
    </anomaly>
    <anomaly type="notice" value="0.535999,0.968949,503,1 0 0 0 0 0 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="33.116.188.185" dst_ip="138.170.223.39" src_port="80"/>
        </slice>
        <from usec="0" sec="1236056959"/>
        <to usec="0" sec="1236057031"/>
    </anomaly>
    <anomaly type="notice" value="0.535999,0.968949,503,1 0 0 0 0 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="140.10.111.129"/>
        </slice>
        <from usec="0" sec="1236056959"/>
        <to usec="0" sec="1236056963"/>
    </anomaly>
    <anomaly type="notice" value="0.535999,0.968949,999,1 0 0 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="203.238.200.206" dst_ip="212.119.91.191"/>
            <filter src_ip="203.238.200.206" src_port="3124"/>
            <filter src_ip="203.238.200.206" src_port="3127"/>
        </slice>
        <from usec="0" sec="1236056558"/>
        <to usec="0" sec="1236057138"/>
    </anomaly>
    <anomaly type="notice" value="0.535999,0.968949,503,1 0 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="138.170.220.145"/>
        </slice>
        <from usec="0" sec="1236057134"/>
        <to usec="0" sec="1236057138"/>
    </anomaly>
    <anomaly type="notice" value="0.535999,0.968949,503,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="138.170.151.210" dst_ip="203.57.30.241" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1236056957"/>
        <to usec="0" sec="1236056963"/>
    </anomaly>
    <anomaly type="notice" value="0.535999,0.968949,503,1 0 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="138.170.40.29" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1236056970"/>
        <to usec="0" sec="1236056973"/>
    </anomaly>
    <anomaly type="notice" value="0.535999,0.968949,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="208.196.169.122"/>
        </slice>
        <from usec="0" sec="1236056970"/>
        <to usec="0" sec="1236056973"/>
    </anomaly>
    <anomaly type="notice" value="0.535999,0.968949,503,1 0 0 0 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="195.175.79.113"/>
        </slice>
        <from usec="0" sec="1236057027"/>
        <to usec="0" sec="1236057031"/>
    </anomaly>
    <anomaly type="notice" value="0.535999,0.968949,999,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="106.133.147.60"/>
        </slice>
        <from usec="0" sec="1236057048"/>
        <to usec="0" sec="1236057055"/>
    </anomaly>
    <anomaly type="notice" value="0.535999,0.968949,503,1 0 0 0 0 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="138.170.232.90"/>
        </slice>
        <from usec="0" sec="1236057048"/>
        <to usec="0" sec="1236057052"/>
    </anomaly>
    <anomaly type="notice" value="0.535999,0.968949,010,1 0 0 0 0 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="201.193.95.8" proto="tcp"/>
        </slice>
        <from usec="0" sec="1236056716"/>
        <to usec="0" sec="1236056853"/>
    </anomaly>
    <anomaly type="notice" value="0.535999,0.968949,503,1 0 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="203.238.198.164"/>
        </slice>
        <from usec="0" sec="1236056948"/>
        <to usec="0" sec="1236056951"/>
    </anomaly>
    <anomaly type="notice" value="0.535999,0.968949,503,1 0 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="138.170.192.165" dst_port="80"/>
        </slice>
        <from usec="0" sec="1236056802"/>
        <to usec="0" sec="1236057143"/>
    </anomaly>
    <anomaly type="notice" value="0.535999,0.968949,503,1 0 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="35.65.124.40"/>
        </slice>
        <from usec="0" sec="1236057005"/>
        <to usec="0" sec="1236057009"/>
    </anomaly>
    <anomaly type="notice" value="0.518313,0.981698,999,0 0 0 0 0 0 1 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="212.119.91.191" dst_ip="203.238.200.206"/>
            <filter src_ip="212.119.91.191" dst_port="3128"/>
            <filter dst_ip="203.238.200.206" dst_port="3128"/>
            <filter dst_ip="203.238.200.206" dst_port="3127"/>
            <filter dst_ip="203.238.200.193" dst_port="3128"/>
        </slice>
        <from usec="0" sec="1236056401"/>
        <to usec="0" sec="1236056762"/>
    </anomaly>
    <anomaly type="notice" value="0.591085,0.991639,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.238.193.64" dst_port="53"/>
        </slice>
        <from usec="0" sec="1236056401"/>
        <to usec="0" sec="1236056762"/>
    </anomaly>
    <anomaly type="notice" value="0.518313,0.981698,010,0 0 0 0 0 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="14.190.178.50"/>
        </slice>
        <from usec="0" sec="1236056536"/>
        <to usec="0" sec="1236056582"/>
    </anomaly>
    <anomaly type="notice" value="0.518313,0.981698,999,0 0 0 0 0 0 1 0 0 0 0 0,mptmp">
        <slice>
            <filter src_port="8582" dst_port="53"/>
        </slice>
        <from usec="0" sec="1236056401"/>
        <to usec="0" sec="1236056582"/>
    </anomaly>
    <anomaly type="notice" value="0.518313,0.981698,999,0 0 0 0 0 0 1 0 0 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="195.140.93.29" dst_ip="208.225.242.177" src_port="53"/>
        </slice>
        <from usec="0" sec="1236056401"/>
        <to usec="0" sec="1236056762"/>
    </anomaly>
    <anomaly type="notice" value="0.591085,0.991639,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.238.196.36" dst_port="16881"/>
        </slice>
        <from usec="0" sec="1236056401"/>
        <to usec="0" sec="1236056762"/>
    </anomaly>
    <anomaly type="notice" value="0.591085,0.991639,999,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="140.10.173.15" dst_port="49763"/>
        </slice>
        <from usec="0" sec="1236056401"/>
        <to usec="0" sec="1236056762"/>
    </anomaly>
    <anomaly type="notice" value="0.591085,0.991639,010,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="163.78.199.227" dst_port="3128"/>
            <filter dst_ip="163.78.199.227" src_port="53" dst_port="8582"/>
        </slice>
        <from usec="0" sec="1236056401"/>
        <to usec="0" sec="1236056762"/>
    </anomaly>
    <anomaly type="notice" value="0.640337,0.971380,999,1 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="203.238.202.93" dst_port="10404"/>
        </slice>
        <from usec="0" sec="1236056401"/>
        <to usec="0" sec="1236057173"/>
    </anomaly>
    <anomaly type="notice" value="0.591085,0.991639,503,0 0 0 0 0 0 1 1 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="203.238.192.178" dst_port="80"/>
        </slice>
        <from usec="0" sec="1236056401"/>
        <to usec="0" sec="1236056762"/>
    </anomaly>
    <anomaly type="notice" value="0.591085,0.991639,999,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="160.9.246.39" dst_port="36141"/>
        </slice>
        <from usec="0" sec="1236056401"/>
        <to usec="0" sec="1236056762"/>
    </anomaly>
    <anomaly type="notice" value="0.518313,0.981698,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="138.170.6.222" src_port="53"/>
        </slice>
        <from usec="0" sec="1236056716"/>
        <to usec="0" sec="1236056762"/>
    </anomaly>
    <anomaly type="notice" value="0.518313,0.981698,999,0 0 0 0 0 0 1 0 0 0 0 0,heavy_hitter">
        <slice>
            <filter src_ip="212.119.91.191" dst_ip="203.238.200.207" dst_port="3128"/>
        </slice>
        <from usec="0" sec="1236056401"/>
        <to usec="0" sec="1236056762"/>
    </anomaly>
    <anomaly type="notice" value="0.591085,0.991639,999,0 0 0 0 0 0 1 1 0 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="202.130.193.28" dst_ip="10.64.169.8" src_port="53"/>
        </slice>
        <from usec="0" sec="1236056401"/>
        <to usec="0" sec="1236056762"/>
    </anomaly>
    <anomaly type="notice" value="0.640337,0.971380,999,1 0 0 0 0 0 1 1 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="203.238.193.87" dst_ip="52.44.196.41" dst_port="53"/>
        </slice>
        <from usec="0" sec="1236056716"/>
        <to usec="0" sec="1236057034"/>
    </anomaly>
    <anomaly type="notice" value="0.591085,0.991639,999,0 0 0 0 0 0 1 1 0 0 0 0,rflatDNS">
        <slice>
            <filter dst_ip="104.1.165.239" src_port="53"/>
        </slice>
        <from usec="0" sec="1236056491"/>
        <to usec="0" sec="1236057212"/>
    </anomaly>
    <anomaly type="notice" value="0.591085,0.991639,999,0 0 0 0 0 0 1 1 0 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="202.130.193.28" dst_ip="10.11.42.103" src_port="53"/>
        </slice>
        <from usec="0" sec="1236056401"/>
        <to usec="0" sec="1236056762"/>
    </anomaly>
    <anomaly type="notice" value="0.640337,0.971380,999,1 0 0 0 0 0 1 1 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="104.1.165.239" dst_port="53"/>
        </slice>
        <from usec="0" sec="1236056401"/>
        <to usec="0" sec="1236057008"/>
    </anomaly>
    <anomaly type="notice" value="0.591085,0.991639,999,0 0 0 0 0 0 1 1 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="163.78.244.69" dst_ip="56.237.182.169" dst_port="53"/>
        </slice>
        <from usec="0" sec="1236056716"/>
        <to usec="0" sec="1236057167"/>
    </anomaly>
    <anomaly type="notice" value="0.591085,0.991639,999,0 0 0 0 0 0 1 1 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="140.172.124.122" dst_port="30048"/>
        </slice>
        <from usec="0" sec="1236056401"/>
        <to usec="0" sec="1236056447"/>
    </anomaly>
    <anomaly type="notice" value="0.591085,0.991639,999,0 0 0 0 0 0 1 1 0 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="35.219.90.96" dst_ip="203.238.193.87" src_port="53"/>
        </slice>
        <from usec="0" sec="1236056401"/>
        <to usec="0" sec="1236056447"/>
    </anomaly>
    <anomaly type="notice" value="0.591085,0.991639,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="160.9.13.66" dst_port="52634"/>
        </slice>
        <from usec="0" sec="1236056401"/>
        <to usec="0" sec="1236056447"/>
    </anomaly>
    <anomaly type="notice" value="0.591085,0.991639,020,0 0 0 0 0 0 1 1 0 0 0 0,ntscICecrqICecrprp">
        <slice>
            <filter dst_ip="109.49.7.137"/>
        </slice>
        <from usec="0" sec="1236056401"/>
        <to usec="0" sec="1236056447"/>
    </anomaly>
    <anomaly type="notice" value="0.591085,0.991639,999,0 0 0 0 0 0 1 1 0 0 0 0,rflatDNS">
        <slice>
            <filter dst_ip="104.1.165.239" src_port="53"/>
        </slice>
        <from usec="0" sec="1236056401"/>
        <to usec="0" sec="1236056447"/>
    </anomaly>
    <anomaly type="notice" value="0.591085,0.991639,999,0 0 0 0 0 0 1 1 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="104.1.165.239" dst_port="53"/>
        </slice>
        <from usec="0" sec="1236056401"/>
        <to usec="0" sec="1236056447"/>
    </anomaly>
    <anomaly type="notice" value="0.591085,0.991639,999,0 0 0 0 0 0 1 1 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="163.78.199.226" dst_ip="220.81.96.45"/>
            <filter src_ip="163.78.199.235" dst_ip="220.81.96.45"/>
        </slice>
        <from usec="0" sec="1236056401"/>
        <to usec="0" sec="1236056447"/>
    </anomaly>
    <anomaly type="notice" value="0.591085,0.991639,503,0 0 0 0 0 0 1 1 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="200.209.76.145" dst_ip="203.238.200.207" dst_port="80"/>
            <filter src_ip="47.223.143.249" dst_ip="203.238.200.207" dst_port="80"/>
            <filter src_ip="52.140.78.97" dst_ip="203.238.200.207" dst_port="80"/>
        </slice>
        <from usec="0" sec="1236056401"/>
        <to usec="0" sec="1236056447"/>
    </anomaly>
    <anomaly type="notice" value="0.591085,0.991639,999,0 0 0 0 0 0 1 1 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="203.238.193.87" dst_ip="91.112.85.59" dst_port="53"/>
        </slice>
        <from usec="0" sec="1236056401"/>
        <to usec="0" sec="1236056447"/>
    </anomaly>
    <anomaly type="notice" value="0.591085,0.991639,999,0 0 0 0 0 0 1 1 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="203.238.193.87" dst_ip="91.112.84.142" dst_port="53"/>
        </slice>
        <from usec="0" sec="1236056401"/>
        <to usec="0" sec="1236056447"/>
    </anomaly>
    <anomaly type="notice" value="0.591085,0.991639,999,0 0 0 0 0 0 1 1 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="163.78.244.69" dst_ip="149.14.66.214" dst_port="53"/>
        </slice>
        <from usec="0" sec="1236056401"/>
        <to usec="0" sec="1236056447"/>
    </anomaly>
    <anomaly type="notice" value="0.591085,0.991639,999,0 0 0 0 0 0 1 1 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="203.238.193.87" dst_ip="91.112.89.13" dst_port="53"/>
        </slice>
        <from usec="0" sec="1236056401"/>
        <to usec="0" sec="1236056447"/>
    </anomaly>
    <anomaly type="notice" value="0.591085,0.991639,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="202.38.209.47" dst_port="53"/>
        </slice>
        <from usec="0" sec="1236056401"/>
        <to usec="0" sec="1236056447"/>
    </anomaly>
    <anomaly type="notice" value="0.591085,0.991639,999,0 0 0 0 0 0 1 1 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="163.78.244.69" dst_ip="105.25.123.180" dst_port="53"/>
            <filter src_ip="163.78.245.77" dst_ip="105.25.123.180" dst_port="53"/>
        </slice>
        <from usec="0" sec="1236056401"/>
        <to usec="0" sec="1236056447"/>
    </anomaly>
    <anomaly type="notice" value="0.591085,0.991639,999,0 0 0 0 0 0 1 1 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="203.238.193.87" dst_ip="33.99.69.48" dst_port="53"/>
        </slice>
        <from usec="0" sec="1236056401"/>
        <to usec="0" sec="1236056447"/>
    </anomaly>
    <anomaly type="notice" value="0.591085,0.991639,999,0 0 0 0 0 0 1 1 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="203.238.193.87" dst_ip="33.99.69.49" dst_port="53"/>
        </slice>
        <from usec="0" sec="1236056401"/>
        <to usec="0" sec="1236056447"/>
    </anomaly>
    <anomaly type="notice" value="0.591085,0.991639,503,0 0 0 0 0 0 1 1 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="106.99.12.106" dst_port="80"/>
        </slice>
        <from usec="0" sec="1236056401"/>
        <to usec="0" sec="1236056447"/>
    </anomaly>
    <anomaly type="notice" value="0.591085,0.991639,999,0 0 0 0 0 0 1 1 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="163.78.244.69" dst_ip="60.230.78.169" dst_port="53"/>
        </slice>
        <from usec="0" sec="1236056401"/>
        <to usec="0" sec="1236056447"/>
    </anomaly>
    <anomaly type="notice" value="0.591085,0.991639,999,0 0 0 0 0 0 1 1 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="203.238.193.87" dst_ip="33.77.35.191" dst_port="53"/>
        </slice>
        <from usec="0" sec="1236056401"/>
        <to usec="0" sec="1236056447"/>
    </anomaly>
    <anomaly type="notice" value="0.591085,0.991639,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="202.43.51.157" src_port="8129"/>
        </slice>
        <from usec="0" sec="1236056671"/>
        <to usec="0" sec="1236056717"/>
    </anomaly>
    <anomaly type="notice" value="0.591085,0.991639,999,0 0 0 0 0 0 1 1 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="203.238.202.93" src_port="10404"/>
        </slice>
        <from usec="0" sec="1236056671"/>
        <to usec="0" sec="1236056717"/>
    </anomaly>
    <anomaly type="notice" value="0.591085,0.991639,999,0 0 0 0 0 0 1 1 0 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="202.130.193.28" dst_ip="172.16.7.5" src_port="53"/>
        </slice>
        <from usec="0" sec="1236056716"/>
        <to usec="0" sec="1236056762"/>
    </anomaly>
    <anomaly type="notice" value="0.591085,0.991639,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="140.152.129.88" dst_port="24672"/>
        </slice>
        <from usec="0" sec="1236056716"/>
        <to usec="0" sec="1236056762"/>
    </anomaly>
    <anomaly type="notice" value="0.591085,0.991639,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="148.83.133.46" dst_port="56560"/>
        </slice>
        <from usec="0" sec="1236056716"/>
        <to usec="0" sec="1236056762"/>
    </anomaly>
    <anomaly type="notice" value="0.591085,0.991639,999,0 0 0 0 0 0 1 1 0 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="202.130.193.28" dst_ip="10.64.169.9" src_port="53"/>
        </slice>
        <from usec="0" sec="1236056401"/>
        <to usec="0" sec="1236056762"/>
    </anomaly>
    <anomaly type="notice" value="0.591085,0.991639,999,0 0 0 0 0 0 1 1 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="56.237.182.169" dst_ip="163.78.244.69" src_port="53"/>
            <filter src_ip="212.83.108.24" dst_ip="163.78.244.69" src_port="53"/>
        </slice>
        <from usec="0" sec="1236056716"/>
        <to usec="0" sec="1236056762"/>
    </anomaly>
    <anomaly type="notice" value="0.640337,0.971380,999,1 0 0 0 0 0 1 1 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="58.188.40.153" dst_ip="203.238.200.206"/>
            <filter src_ip="58.188.40.153" dst_ip="203.238.200.193"/>
            <filter src_ip="58.188.40.153" dst_port="3124"/>
            <filter src_ip="58.188.40.153" dst_port="3127"/>
            <filter dst_ip="203.238.200.206" dst_port="3124"/>
            <filter dst_ip="203.238.200.206" dst_port="3127"/>
            <filter dst_ip="203.238.200.193" dst_port="3128"/>
        </slice>
        <from usec="0" sec="1236056401"/>
        <to usec="0" sec="1236057212"/>
    </anomaly>
    <anomaly type="notice" value="0.591085,0.991639,010,0 0 0 0 0 0 1 1 0 0 0 0,ptpDoSSYN">
        <slice>
            <filter src_ip="212.119.91.191" dst_ip="203.238.200.192" dst_port="3127"/>
        </slice>
        <from usec="0" sec="1236056401"/>
        <to usec="0" sec="1236056762"/>
    </anomaly>
    <anomaly type="notice" value="0.591085,0.991639,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.238.196.50" dst_port="16881"/>
        </slice>
        <from usec="0" sec="1236056401"/>
        <to usec="0" sec="1236056762"/>
    </anomaly>
    <anomaly type="notice" value="0.591085,0.991639,503,0 0 0 0 0 0 1 1 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="138.170.168.120" dst_ip="86.91.127.194" dst_port="80"/>
        </slice>
        <from usec="0" sec="1236056716"/>
        <to usec="0" sec="1236056762"/>
    </anomaly>
    <anomaly type="notice" value="0.591085,0.991639,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="202.43.51.157" dst_port="8129"/>
        </slice>
        <from usec="0" sec="1236056716"/>
        <to usec="0" sec="1236056762"/>
    </anomaly>
    <anomaly type="notice" value="0.591085,0.991639,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.238.208.214" dst_port="6881"/>
        </slice>
        <from usec="0" sec="1236056401"/>
        <to usec="0" sec="1236056762"/>
    </anomaly>
    <anomaly type="notice" value="0.591085,0.991639,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="140.172.186.113" dst_port="22880"/>
        </slice>
        <from usec="0" sec="1236056716"/>
        <to usec="0" sec="1236056762"/>
    </anomaly>
    <anomaly type="notice" value="0.591085,0.991639,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="202.43.43.204" dst_port="22074"/>
        </slice>
        <from usec="0" sec="1236056401"/>
        <to usec="0" sec="1236056762"/>
    </anomaly>
    <anomaly type="notice" value="0.518313,0.981698,999,0 0 0 0 0 0 1 0 0 0 0 0,rflatDNS">
        <slice>
            <filter dst_ip="140.10.142.103" src_port="53"/>
        </slice>
        <from usec="0" sec="1236056401"/>
        <to usec="0" sec="1236056447"/>
    </anomaly>
    <anomaly type="notice" value="0.591085,0.991639,010,0 0 0 0 0 0 1 1 0 0 0 0,ptpDoSSYN">
        <slice>
            <filter src_ip="138.170.200.54" dst_ip="192.234.243.161" dst_port="443"/>
        </slice>
        <from usec="0" sec="1236056716"/>
        <to usec="0" sec="1236056762"/>
    </anomaly>
    <anomaly type="notice" value="0.591085,0.991639,999,0 0 0 0 0 0 1 1 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="13.196.206.239" dst_ip="163.78.42.118" dst_port="24221"/>
        </slice>
        <from usec="0" sec="1236056401"/>
        <to usec="0" sec="1236056762"/>
    </anomaly>
    <anomaly type="notice" value="0.591085,0.991639,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.238.217.92" dst_port="6881"/>
        </slice>
        <from usec="0" sec="1236056401"/>
        <to usec="0" sec="1236056762"/>
    </anomaly>
    <anomaly type="notice" value="0.591085,0.991639,999,0 0 0 0 0 0 1 1 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="163.78.199.235" dst_ip="192.88.2.165"/>
            <filter src_ip="203.238.200.193" dst_ip="192.88.2.165"/>
        </slice>
        <from usec="0" sec="1236056716"/>
        <to usec="0" sec="1236056762"/>
    </anomaly>
    <anomaly type="notice" value="0.591085,0.991639,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="202.38.211.208" dst_port="2154"/>
        </slice>
        <from usec="0" sec="1236056716"/>
        <to usec="0" sec="1236056762"/>
    </anomaly>
    <anomaly type="notice" value="0.591085,0.991639,503,0 0 0 0 0 0 1 1 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="160.36.200.12" dst_ip="138.170.171.142" src_port="80"/>
        </slice>
        <from usec="0" sec="1236056716"/>
        <to usec="0" sec="1236056762"/>
    </anomaly>
    <anomaly type="notice" value="0.591085,0.991639,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="140.152.112.44" dst_port="49454"/>
        </slice>
        <from usec="0" sec="1236056716"/>
        <to usec="0" sec="1236056762"/>
    </anomaly>
    <anomaly type="notice" value="0.591085,0.991639,999,0 0 0 0 0 0 1 1 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="163.78.244.69" dst_ip="212.83.108.24" dst_port="53"/>
        </slice>
        <from usec="0" sec="1236056536"/>
        <to usec="0" sec="1236056762"/>
    </anomaly>
    <anomaly type="notice" value="0.591085,0.991639,999,0 0 0 0 0 0 1 1 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="203.238.193.87" dst_ip="197.212.35.28" dst_port="53"/>
        </slice>
        <from usec="0" sec="1236056716"/>
        <to usec="0" sec="1236056762"/>
    </anomaly>
    <anomaly type="notice" value="0.591085,0.991639,503,0 0 0 0 0 0 1 1 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="34.43.135.176" dst_ip="203.238.200.207" dst_port="80"/>
            <filter src_ip="200.209.76.145" dst_ip="203.238.200.207" dst_port="80"/>
        </slice>
        <from usec="0" sec="1236056716"/>
        <to usec="0" sec="1236056762"/>
    </anomaly>
    <anomaly type="notice" value="0.591085,0.991639,999,0 0 0 0 0 0 1 1 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="203.238.193.87" dst_ip="197.212.35.24" dst_port="53"/>
        </slice>
        <from usec="0" sec="1236056716"/>
        <to usec="0" sec="1236056762"/>
    </anomaly>
    <anomaly type="notice" value="0.591085,0.991639,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="195.140.93.24" dst_port="53"/>
        </slice>
        <from usec="0" sec="1236056401"/>
        <to usec="0" sec="1236056762"/>
    </anomaly>
    <anomaly type="notice" value="0.591085,0.991639,503,0 0 0 0 0 0 1 1 0 0 0 0,point_to_point">
        <slice>
            <filter src_ip="120.106.115.7" dst_ip="163.78.199.154" dst_port="80"/>
        </slice>
        <from usec="0" sec="1236056716"/>
        <to usec="0" sec="1236056762"/>
    </anomaly>
    <anomaly type="notice" value="0.591085,0.991639,999,0 0 0 0 0 0 1 1 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="203.238.205.167" dst_port="53"/>
            <filter dst_ip="194.130.33.238" dst_port="53"/>
        </slice>
        <from usec="0" sec="1236056401"/>
        <to usec="0" sec="1236056447"/>
    </anomaly>
    <anomaly type="notice" value="0.591085,0.991639,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.238.193.69" dst_port="53"/>
        </slice>
        <from usec="0" sec="1236056401"/>
        <to usec="0" sec="1236056762"/>
    </anomaly>
    <anomaly type="notice" value="0.591085,0.991639,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.238.193.70" dst_port="53"/>
        </slice>
        <from usec="0" sec="1236056716"/>
        <to usec="0" sec="1236056762"/>
    </anomaly>
    <anomaly type="notice" value="0.591085,0.991639,503,0 0 0 0 0 0 1 1 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="106.99.12.106" dst_port="80"/>
        </slice>
        <from usec="0" sec="1236056716"/>
        <to usec="0" sec="1236056762"/>
    </anomaly>
    <anomaly type="notice" value="0.591085,0.991639,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.238.199.71" dst_port="53"/>
        </slice>
        <from usec="0" sec="1236056401"/>
        <to usec="0" sec="1236056762"/>
    </anomaly>
    <anomaly type="notice" value="0.591085,0.991639,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="202.38.193.8" dst_port="53"/>
        </slice>
        <from usec="0" sec="1236056401"/>
        <to usec="0" sec="1236056762"/>
    </anomaly>
</admd:annotation>
