<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="anomalous" value="2.125890,1.718860,010,1 1 1 1 1 1 1 1 1 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="216.204.5.111" src_port="6000" dst_port="135"/>
        </slice>
        <from usec="0" sec="1238821380"/>
        <to usec="0" sec="1238821861"/>
    </anomaly>
    <anomaly type="anomalous" value="1.105640,0.977860,999,1 1 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="203.223.62.72" src_port="53"/>
        </slice>
        <from usec="0" sec="1238821200"/>
        <to usec="0" sec="1238822093"/>
    </anomaly>
    <anomaly type="anomalous" value="0.993007,0.989058,504,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="139.36.76.143" dst_ip="21.197.6.153" src_port="3544" dst_port="443"/>
        </slice>
        <from usec="0" sec="1238821578"/>
        <to usec="0" sec="1238821808"/>
    </anomaly>
    <anomaly type="anomalous" value="1.452950,1.333350,503,1 1 1 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="28.41.185.3" dst_ip="171.234.128.41" src_port="38790" dst_port="80"/>
        </slice>
        <from usec="0" sec="1238821725"/>
        <to usec="0" sec="1238821729"/>
    </anomaly>
    <anomaly type="anomalous" value="1.452950,1.333350,503,1 1 1 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="139.36.196.53" src_port="35017"/>
            <filter src_ip="139.36.196.53" dst_port="80"/>
            <filter src_ip="139.36.196.53" dst_ip="119.132.90.150" dst_port="123"/>
        </slice>
        <from usec="0" sec="1238821718"/>
        <to usec="0" sec="1238821722"/>
    </anomaly>
    <anomaly type="anomalous" value="1.452950,1.333350,503,1 1 1 0 0 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="171.234.81.41" dst_ip="195.109.206.126" dst_port="80"/>
            <filter src_ip="203.12.35.168" dst_ip="195.109.206.126" dst_port="80"/>
        </slice>
        <from usec="0" sec="1238821728"/>
        <to usec="0" sec="1238821732"/>
    </anomaly>
    <anomaly type="anomalous" value="1.452950,1.333350,503,1 1 1 0 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="202.176.5.205" dst_port="80"/>
        </slice>
        <from usec="0" sec="1238821721"/>
        <to usec="0" sec="1238821726"/>
    </anomaly>
    <anomaly type="anomalous" value="0.993007,0.989058,501,1 1 0 0 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="173.171.64.165" dst_port="21"/>
            <filter dst_ip="173.171.64.165" dst_port="20"/>
        </slice>
        <from usec="0" sec="1238821718"/>
        <to usec="0" sec="1238821784"/>
    </anomaly>
    <anomaly type="anomalous" value="0.968808,0.950052,002,1 1 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="180.160.74.81" src_port="62893" dst_port="137"/>
        </slice>
        <from usec="0" sec="1238821560"/>
        <to usec="0" sec="1238821606"/>
    </anomaly>
    <anomaly type="anomalous" value="0.968808,0.950052,002,1 1 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="1.123.118.201" src_port="1025" dst_port="137"/>
        </slice>
        <from usec="0" sec="1238821560"/>
        <to usec="0" sec="1238821606"/>
    </anomaly>
    <anomaly type="anomalous" value="1.436520,1.304680,999,1 1 1 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="85.12.243.147" src_port="42017" dst_port="1026"/>
            <filter src_ip="85.12.243.147" src_port="42017" dst_port="1027"/>
        </slice>
        <from usec="0" sec="1238821560"/>
        <to usec="0" sec="1238821606"/>
    </anomaly>
    <anomaly type="anomalous" value="1.452950,1.333350,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="33.129.86.212" src_port="6000" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1238821547"/>
        <to usec="0" sec="1238821550"/>
    </anomaly>
    <anomaly type="anomalous" value="1.105640,0.977860,999,1 1 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="195.18.90.17" src_port="53"/>
        </slice>
        <from usec="0" sec="1238821200"/>
        <to usec="0" sec="1238822093"/>
    </anomaly>
    <anomaly type="anomalous" value="1.452950,1.333350,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="42.171.34.201" dst_port="25"/>
        </slice>
        <from usec="0" sec="1238821717"/>
        <to usec="0" sec="1238821731"/>
    </anomaly>
    <anomaly type="anomalous" value="0.993007,0.989058,010,1 1 0 0 0 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="173.168.42.29" dst_port="445"/>
        </slice>
        <from usec="0" sec="1238821501"/>
        <to usec="0" sec="1238821812"/>
    </anomaly>
    <anomaly type="anomalous" value="1.452950,1.333350,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICecrqICecrqdurmterp">
        <slice>
            <filter dst_ip="81.179.25.86"/>
        </slice>
        <from usec="0" sec="1238822016"/>
        <to usec="0" sec="1238822089"/>
    </anomaly>
    <anomaly type="anomalous" value="1.452950,1.333350,503,1 1 1 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="139.36.63.48" dst_ip="85.173.64.157" dst_port="80"/>
            <filter src_ip="139.36.63.48" dst_ip="215.0.211.112" dst_port="80"/>
            <filter src_ip="139.36.63.48" dst_ip="119.67.49.232" dst_port="993"/>
        </slice>
        <from usec="0" sec="1238821715"/>
        <to usec="0" sec="1238821719"/>
    </anomaly>
    <anomaly type="anomalous" value="1.497640,1.330640,999,1 1 1 1 0 0 1 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="140.85.241.22" dst_port="53"/>
            <filter dst_ip="22.149.177.101" dst_port="53"/>
            <filter src_ip="202.176.8.16" src_port="51440" dst_port="53"/>
        </slice>
        <from usec="0" sec="1238821200"/>
        <to usec="0" sec="1238822093"/>
    </anomaly>
    <anomaly type="anomalous" value="1.532140,1.325070,020,1 1 1 0 0 0 1 1 1 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="216.204.5.111"/>
        </slice>
        <from usec="0" sec="1238821380"/>
        <to usec="0" sec="1238821426"/>
    </anomaly>
    <anomaly type="anomalous" value="1.452950,1.333350,020,1 1 1 0 0 0 0 0 0 0 0 0,icmp_error">
        <slice>
            <filter dst_ip="202.176.8.16" src_port="53" dst_port="51440"/>
            <filter dst_ip="202.176.8.16"/>
        </slice>
        <from usec="0" sec="1238822015"/>
        <to usec="0" sec="1238822093"/>
    </anomaly>
    <anomaly type="anomalous" value="1.683590,1.378650,503,1 0 0 1 1 1 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="202.176.0.249" dst_port="80"/>
        </slice>
        <from usec="0" sec="1238821200"/>
        <to usec="0" sec="1238822028"/>
    </anomaly>
    <anomaly type="anomalous" value="1.683590,1.378650,503,1 0 0 1 1 1 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="202.176.0.248" dst_port="80"/>
        </slice>
        <from usec="0" sec="1238821200"/>
        <to usec="0" sec="1238822028"/>
    </anomaly>
    <anomaly type="anomalous" value="1.842390,1.467950,020,1 1 0 1 1 1 1 1 1 0 0 0,ntscICec">
        <slice>
            <filter src_ip="4.153.107.154"/>
        </slice>
        <from usec="0" sec="1238821200"/>
        <to usec="0" sec="1238821653"/>
    </anomaly>
    <anomaly type="anomalous" value="1.842390,1.467950,503,1 1 0 1 1 1 1 1 1 0 0 0,ntscACK">
        <slice>
            <filter src_ip="202.176.0.248" src_port="80"/>
        </slice>
        <from usec="0" sec="1238821200"/>
        <to usec="0" sec="1238822093"/>
    </anomaly>
    <anomaly type="anomalous" value="1.611860,1.386610,503,1 0 0 1 1 1 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="139.36.168.6" dst_port="80"/>
        </slice>
        <from usec="0" sec="1238821200"/>
        <to usec="0" sec="1238822028"/>
    </anomaly>
    <anomaly type="anomalous" value="1.561840,1.380020,503,0 0 0 1 1 1 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="203.12.35.168" src_port="53"/>
            <filter dst_ip="203.12.35.168" src_port="80"/>
        </slice>
        <from usec="0" sec="1238821200"/>
        <to usec="0" sec="1238821758"/>
    </anomaly>
    <anomaly type="anomalous" value="1.561840,1.380020,503,0 0 0 1 1 1 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="139.36.14.123" dst_ip="213.186.120.104" src_port="80"/>
            <filter src_ip="139.36.14.123" dst_ip="29.165.74.95" src_port="80"/>
        </slice>
        <from usec="0" sec="1238821601"/>
        <to usec="0" sec="1238821779"/>
    </anomaly>
    <anomaly type="anomalous" value="1.269800,1.124500,503,0 0 0 1 1 0 1 1 1 0 0 0,ntscACK">
        <slice>
            <filter src_ip="202.176.8.226" src_port="80"/>
        </slice>
        <from usec="0" sec="1238821200"/>
        <to usec="0" sec="1238821938"/>
    </anomaly>
    <anomaly type="anomalous" value="1.561840,1.380020,503,0 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="202.176.7.86" dst_ip="33.18.168.39" src_port="80"/>
        </slice>
        <from usec="0" sec="1238821757"/>
        <to usec="0" sec="1238821934"/>
    </anomaly>
    <anomaly type="anomalous" value="1.173040,1.134250,503,0 0 0 1 1 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="202.176.8.226" dst_port="80"/>
        </slice>
        <from usec="0" sec="1238821200"/>
        <to usec="0" sec="1238822028"/>
    </anomaly>
    <anomaly type="anomalous" value="1.561840,1.380020,503,0 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="152.51.238.112" dst_ip="28.41.189.189" src_port="80"/>
        </slice>
        <from usec="0" sec="1238821230"/>
        <to usec="0" sec="1238821989"/>
    </anomaly>
    <anomaly type="anomalous" value="1.561840,1.380020,503,0 0 0 1 1 1 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="139.36.146.28" dst_ip="141.39.204.191" src_port="80"/>
            <filter src_ip="139.36.146.28" dst_ip="28.41.189.107" src_port="80"/>
        </slice>
        <from usec="0" sec="1238821206"/>
        <to usec="0" sec="1238822028"/>
    </anomaly>
    <anomaly type="anomalous" value="1.561840,1.380020,503,0 0 0 1 1 1 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="171.234.211.64" dst_ip="28.41.189.178" src_port="80"/>
            <filter src_ip="171.234.211.64" dst_ip="22.129.52.100" src_port="80"/>
        </slice>
        <from usec="0" sec="1238821212"/>
        <to usec="0" sec="1238821429"/>
    </anomaly>
    <anomaly type="anomalous" value="1.561840,1.380020,999,0 0 0 1 1 1 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="171.234.81.213" src_port="7638"/>
        </slice>
        <from usec="0" sec="1238821200"/>
        <to usec="0" sec="1238821578"/>
    </anomaly>
    <anomaly type="anomalous" value="1.561840,1.380020,503,0 0 0 1 1 1 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="140.72.76.99" dst_ip="28.41.185.4" src_port="80"/>
            <filter src_ip="140.72.119.55" dst_ip="28.41.185.4" src_port="80"/>
        </slice>
        <from usec="0" sec="1238821201"/>
        <to usec="0" sec="1238821931"/>
    </anomaly>
    <anomaly type="anomalous" value="1.183960,1.012240,999,1 1 0 1 0 0 1 1 1 0 0 0,ptmpla">
        <slice>
            <filter src_ip="139.36.227.237" dst_ip="6.224.23.159"/>
            <filter src_ip="139.36.227.237" dst_ip="201.233.97.14"/>
        </slice>
        <from usec="0" sec="1238821200"/>
        <to usec="0" sec="1238821848"/>
    </anomaly>
    <anomaly type="anomalous" value="1.589580,1.350640,999,1 1 1 1 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="195.18.90.17" dst_port="53"/>
        </slice>
        <from usec="0" sec="1238821200"/>
        <to usec="0" sec="1238821966"/>
    </anomaly>
    <anomaly type="anomalous" value="1.105640,0.977860,010,1 1 0 0 0 0 1 1 1 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="220.118.166.40" dst_port="5900"/>
        </slice>
        <from usec="0" sec="1238821362"/>
        <to usec="0" sec="1238821471"/>
    </anomaly>
    <anomaly type="anomalous" value="1.842390,1.467950,503,1 1 0 1 1 1 1 1 1 0 0 0,ntscACK">
        <slice>
            <filter src_ip="202.176.0.249" src_port="80"/>
        </slice>
        <from usec="0" sec="1238821200"/>
        <to usec="0" sec="1238822093"/>
    </anomaly>
    <anomaly type="anomalous" value="1.033590,0.959817,010,1 1 0 0 0 0 1 1 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="85.182.155.17" src_port="6000" dst_port="8080"/>
        </slice>
        <from usec="0" sec="1238821965"/>
        <to usec="0" sec="1238822011"/>
    </anomaly>
    <anomaly type="anomalous" value="0.917505,0.877738,503,1 0 0 1 0 0 1 1 1 0 0 0,ntscACK">
        <slice>
            <filter src_ip="203.12.31.61" dst_port="80"/>
        </slice>
        <from usec="0" sec="1238821252"/>
        <to usec="0" sec="1238821858"/>
    </anomaly>
    <anomaly type="suspicious" value="0.652773,0.850901,999,1 0 0 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="139.36.198.77"/>
        </slice>
        <from usec="0" sec="1238821566"/>
        <to usec="0" sec="1238821861"/>
    </anomaly>
    <anomaly type="suspicious" value="0.652773,0.850901,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="171.234.128.21" dst_ip="22.10.211.157" src_port="80" dst_port="1089" proto="tcp"/>
        </slice>
        <from usec="0" sec="1238821857"/>
        <to usec="0" sec="1238821861"/>
    </anomaly>
    <anomaly type="suspicious" value="0.652773,0.850901,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="203.12.30.3" dst_ip="0.135.235.153" src_port="63992" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1238821501"/>
        <to usec="0" sec="1238821732"/>
    </anomaly>
    <anomaly type="suspicious" value="0.652773,0.850901,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="84.38.82.223" dst_ip="140.133.38.73" src_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1238821486"/>
        <to usec="0" sec="1238821888"/>
    </anomaly>
    <anomaly type="suspicious" value="0.652773,0.850901,999,1 0 0 0 0 0 0 0 0 0 0 0,ipv46tun">
        <slice>
            <filter src_ip="203.12.30.186"/>
        </slice>
        <from usec="0" sec="1238822015"/>
        <to usec="0" sec="1238822021"/>
    </anomaly>
    <anomaly type="suspicious" value="0.652773,0.850901,999,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="202.176.17.41"/>
        </slice>
        <from usec="0" sec="1238821583"/>
        <to usec="0" sec="1238821587"/>
    </anomaly>
    <anomaly type="suspicious" value="0.652773,0.850901,503,1 0 0 0 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="171.234.128.21" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1238821778"/>
        <to usec="0" sec="1238821784"/>
    </anomaly>
    <anomaly type="suspicious" value="0.652773,0.850901,503,1 0 0 0 0 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="139.36.34.43" src_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1238821457"/>
        <to usec="0" sec="1238821461"/>
    </anomaly>
    <anomaly type="suspicious" value="0.652773,0.850901,503,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="84.38.114.244" dst_ip="171.234.21.38" src_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1238822056"/>
        <to usec="0" sec="1238822059"/>
    </anomaly>
    <anomaly type="suspicious" value="0.652773,0.850901,901,1 0 0 0 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="202.176.0.249" dst_ip="202.176.0.249" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1238821588"/>
        <to usec="0" sec="1238821915"/>
    </anomaly>
    <anomaly type="suspicious" value="0.652773,0.850901,999,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="202.176.6.203" dst_ip="40.163.23.165" src_port="3124" proto="tcp"/>
        </slice>
        <from usec="0" sec="1238821750"/>
        <to usec="0" sec="1238821790"/>
    </anomaly>
    <anomaly type="suspicious" value="0.652773,0.850901,503,1 0 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="171.234.4.177"/>
        </slice>
        <from usec="0" sec="1238821655"/>
        <to usec="0" sec="1238821790"/>
    </anomaly>
    <anomaly type="suspicious" value="0.652773,0.850901,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="201.175.36.236"/>
        </slice>
        <from usec="0" sec="1238821655"/>
        <to usec="0" sec="1238821845"/>
    </anomaly>
    <anomaly type="suspicious" value="0.652773,0.850901,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="44.228.10.42" proto="tcp"/>
        </slice>
        <from usec="0" sec="1238821741"/>
        <to usec="0" sec="1238821787"/>
    </anomaly>
    <anomaly type="suspicious" value="0.652773,0.850901,503,1 0 0 0 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="119.40.230.48"/>
        </slice>
        <from usec="0" sec="1238821725"/>
        <to usec="0" sec="1238821729"/>
    </anomaly>
    <anomaly type="suspicious" value="0.652773,0.850901,999,1 0 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="140.85.240.49"/>
        </slice>
        <from usec="0" sec="1238821749"/>
        <to usec="0" sec="1238821753"/>
    </anomaly>
    <anomaly type="suspicious" value="0.652773,0.850901,503,1 0 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="202.176.13.116"/>
        </slice>
        <from usec="0" sec="1238821786"/>
        <to usec="0" sec="1238821790"/>
    </anomaly>
    <anomaly type="suspicious" value="0.652773,0.850901,999,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="28.108.98.77"/>
        </slice>
        <from usec="0" sec="1238821777"/>
        <to usec="0" sec="1238821784"/>
    </anomaly>
    <anomaly type="suspicious" value="0.652773,0.850901,999,1 0 0 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="139.36.26.238"/>
        </slice>
        <from usec="0" sec="1238821746"/>
        <to usec="0" sec="1238821750"/>
    </anomaly>
    <anomaly type="suspicious" value="0.652773,0.850901,002,1 0 0 0 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="203.12.30.179"/>
        </slice>
        <from usec="0" sec="1238821693"/>
        <to usec="0" sec="1238821697"/>
    </anomaly>
    <anomaly type="suspicious" value="0.668362,0.879887,999,0 0 0 1 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="218.92.158.73"/>
        </slice>
        <from usec="0" sec="1238821200"/>
        <to usec="0" sec="1238821467"/>
    </anomaly>
    <anomaly type="suspicious" value="0.778105,0.890196,503,1 0 0 1 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="203.12.31.50" dst_ip="20.141.73.74" dst_port="80"/>
        </slice>
        <from usec="0" sec="1238821275"/>
        <to usec="0" sec="1238821811"/>
    </anomaly>
    <anomaly type="suspicious" value="0.778105,0.890196,999,1 0 0 1 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="42.165.172.89" dst_ip="202.176.17.41" src_port="49392" dst_port="1063"/>
            <filter src_ip="183.128.197.75" dst_ip="202.176.17.41" src_port="50163" dst_port="1063"/>
            <filter src_ip="220.188.155.113" dst_ip="202.176.17.41" src_port="56654" dst_port="1063"/>
            <filter src_ip="26.179.188.36" dst_ip="202.176.17.41" src_port="63177" dst_port="1063"/>
        </slice>
        <from usec="0" sec="1238821200"/>
        <to usec="0" sec="1238821726"/>
    </anomaly>
    <anomaly type="suspicious" value="0.668362,0.879887,503,0 0 0 1 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="29.84.140.150"/>
        </slice>
        <from usec="0" sec="1238821200"/>
        <to usec="0" sec="1238821488"/>
    </anomaly>
    <anomaly type="suspicious" value="0.668362,0.879887,999,0 0 0 1 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="203.0.137.244"/>
        </slice>
        <from usec="0" sec="1238821200"/>
        <to usec="0" sec="1238821488"/>
    </anomaly>
    <anomaly type="suspicious" value="0.778105,0.890196,503,1 0 0 1 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="171.234.13.195" dst_ip="28.41.188.38" src_port="80"/>
            <filter src_ip="171.234.13.195" dst_ip="20.141.40.153" src_port="80"/>
        </slice>
        <from usec="0" sec="1238821206"/>
        <to usec="0" sec="1238821463"/>
    </anomaly>
    <anomaly type="suspicious" value="0.668362,0.879887,503,0 0 0 1 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="206.195.201.41"/>
        </slice>
        <from usec="0" sec="1238821206"/>
        <to usec="0" sec="1238821480"/>
    </anomaly>
    <anomaly type="suspicious" value="0.668362,0.879887,999,0 0 0 1 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="139.36.154.112"/>
        </slice>
        <from usec="0" sec="1238821258"/>
        <to usec="0" sec="1238821478"/>
    </anomaly>
    <anomaly type="suspicious" value="0.668362,0.879887,503,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="180.128.104.64"/>
        </slice>
        <from usec="0" sec="1238821375"/>
        <to usec="0" sec="1238821406"/>
    </anomaly>
    <anomaly type="suspicious" value="0.668362,0.879887,503,0 0 0 1 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="208.170.20.201"/>
        </slice>
        <from usec="0" sec="1238821404"/>
        <to usec="0" sec="1238821464"/>
    </anomaly>
    <anomaly type="suspicious" value="0.668362,0.879887,503,0 0 0 1 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter dst_ip="28.41.189.194"/>
        </slice>
        <from usec="0" sec="1238821201"/>
        <to usec="0" sec="1238821575"/>
    </anomaly>
    <anomaly type="suspicious" value="0.778105,0.890196,999,1 0 0 1 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="214.139.242.2" dst_port="993"/>
            <filter src_ip="139.36.43.144" dst_ip="214.139.242.2" dst_port="995"/>
        </slice>
        <from usec="0" sec="1238821211"/>
        <to usec="0" sec="1238821730"/>
    </anomaly>
    <anomaly type="suspicious" value="0.668362,0.879887,503,0 0 0 1 0 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="26.197.170.211"/>
        </slice>
        <from usec="0" sec="1238821244"/>
        <to usec="0" sec="1238821541"/>
    </anomaly>
    <anomaly type="suspicious" value="0.668362,0.879887,999,0 0 0 1 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="7.201.128.21"/>
        </slice>
        <from usec="0" sec="1238821267"/>
        <to usec="0" sec="1238821578"/>
    </anomaly>
    <anomaly type="suspicious" value="0.668362,0.879887,503,0 0 0 1 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="26.3.130.95"/>
        </slice>
        <from usec="0" sec="1238821277"/>
        <to usec="0" sec="1238821578"/>
    </anomaly>
    <anomaly type="suspicious" value="0.668362,0.879887,503,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter dst_ip="49.32.72.205"/>
        </slice>
        <from usec="0" sec="1238821496"/>
        <to usec="0" sec="1238821500"/>
    </anomaly>
    <anomaly type="suspicious" value="0.668362,0.879887,503,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="152.51.178.91"/>
        </slice>
        <from usec="0" sec="1238821233"/>
        <to usec="0" sec="1238821741"/>
    </anomaly>
    <anomaly type="suspicious" value="0.668362,0.879887,503,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter dst_ip="80.228.204.223"/>
        </slice>
        <from usec="0" sec="1238821473"/>
        <to usec="0" sec="1238821646"/>
    </anomaly>
    <anomaly type="suspicious" value="0.668362,0.879887,503,0 0 0 1 0 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="41.86.194.112"/>
        </slice>
        <from usec="0" sec="1238821504"/>
        <to usec="0" sec="1238821746"/>
    </anomaly>
    <anomaly type="suspicious" value="0.668362,0.879887,503,0 0 0 1 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="140.85.29.140"/>
        </slice>
        <from usec="0" sec="1238821206"/>
        <to usec="0" sec="1238821807"/>
    </anomaly>
    <anomaly type="suspicious" value="0.668362,0.879887,999,0 0 0 1 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="202.176.1.166"/>
        </slice>
        <from usec="0" sec="1238821209"/>
        <to usec="0" sec="1238821829"/>
    </anomaly>
    <anomaly type="suspicious" value="0.668362,0.879887,999,0 0 0 1 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter dst_ip="33.21.24.17"/>
        </slice>
        <from usec="0" sec="1238821200"/>
        <to usec="0" sec="1238821938"/>
    </anomaly>
    <anomaly type="suspicious" value="0.746975,0.846648,999,1 0 0 1 0 0 1 0 0 0 0 0,rflatDNS">
        <slice>
            <filter dst_ip="171.234.191.13" src_port="53"/>
        </slice>
        <from usec="0" sec="1238821200"/>
        <to usec="0" sec="1238821936"/>
    </anomaly>
    <anomaly type="suspicious" value="0.668362,0.879887,010,0 0 0 1 0 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="33.136.93.166"/>
        </slice>
        <from usec="0" sec="1238821201"/>
        <to usec="0" sec="1238821938"/>
    </anomaly>
    <anomaly type="suspicious" value="0.668362,0.879887,503,0 0 0 1 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="202.176.12.77"/>
        </slice>
        <from usec="0" sec="1238821202"/>
        <to usec="0" sec="1238821931"/>
    </anomaly>
    <anomaly type="suspicious" value="0.668362,0.879887,999,0 0 0 1 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="193.50.128.29"/>
        </slice>
        <from usec="0" sec="1238821221"/>
        <to usec="0" sec="1238821936"/>
    </anomaly>
    <anomaly type="suspicious" value="0.668362,0.879887,503,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="136.141.32.210"/>
        </slice>
        <from usec="0" sec="1238821495"/>
        <to usec="0" sec="1238821783"/>
    </anomaly>
    <anomaly type="suspicious" value="0.668362,0.879887,999,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="220.117.2.76"/>
        </slice>
        <from usec="0" sec="1238821754"/>
        <to usec="0" sec="1238821833"/>
    </anomaly>
    <anomaly type="suspicious" value="0.668362,0.879887,999,0 0 0 1 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="173.171.86.144"/>
        </slice>
        <from usec="0" sec="1238821200"/>
        <to usec="0" sec="1238822028"/>
    </anomaly>
    <anomaly type="suspicious" value="0.668362,0.879887,999,0 0 0 1 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="203.0.140.249"/>
        </slice>
        <from usec="0" sec="1238821200"/>
        <to usec="0" sec="1238822028"/>
    </anomaly>
    <anomaly type="suspicious" value="0.668362,0.879887,999,0 0 0 1 0 0 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="171.234.191.13" dst_ip="203.195.82.125" dst_port="53"/>
        </slice>
        <from usec="0" sec="1238821245"/>
        <to usec="0" sec="1238822020"/>
    </anomaly>
    <anomaly type="suspicious" value="0.668362,0.879887,999,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter dst_ip="37.110.5.102"/>
        </slice>
        <from usec="0" sec="1238821904"/>
        <to usec="0" sec="1238822017"/>
    </anomaly>
    <anomaly type="suspicious" value="0.652773,0.850901,503,1 0 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="202.176.5.205" src_port="80"/>
        </slice>
        <from usec="0" sec="1238821246"/>
        <to usec="0" sec="1238821732"/>
    </anomaly>
    <anomaly type="suspicious" value="0.826484,0.867281,999,0 0 0 1 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="208.2.193.33" dst_port="53"/>
        </slice>
        <from usec="0" sec="1238821200"/>
        <to usec="0" sec="1238821754"/>
    </anomaly>
    <anomaly type="suspicious" value="0.709747,0.826899,999,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="202.176.6.192" dst_port="3128"/>
        </slice>
        <from usec="0" sec="1238821200"/>
        <to usec="0" sec="1238821471"/>
    </anomaly>
    <anomaly type="suspicious" value="0.709747,0.826899,999,0 0 0 0 0 0 1 1 1 0 0 0,ipv46tun">
        <slice>
            <filter src_ip="195.154.50.54"/>
        </slice>
        <from usec="0" sec="1238821200"/>
        <to usec="0" sec="1238821426"/>
    </anomaly>
    <anomaly type="suspicious" value="0.709747,0.826899,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="203.12.30.179" src_port="6881"/>
            <filter src_ip="203.12.30.179"/>
        </slice>
        <from usec="0" sec="1238821200"/>
        <to usec="0" sec="1238822056"/>
    </anomaly>
    <anomaly type="suspicious" value="0.813929,0.837859,999,1 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="139.36.205.78" dst_port="53"/>
        </slice>
        <from usec="0" sec="1238821380"/>
        <to usec="0" sec="1238821659"/>
    </anomaly>
    <anomaly type="suspicious" value="0.709747,0.826899,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="195.18.90.20" src_port="53"/>
        </slice>
        <from usec="0" sec="1238821200"/>
        <to usec="0" sec="1238821426"/>
    </anomaly>
    <anomaly type="suspicious" value="0.709747,0.826899,503,0 0 0 0 0 0 1 1 1 0 0 0,ntscACK">
        <slice>
            <filter src_ip="171.234.128.21" src_port="80"/>
        </slice>
        <from usec="0" sec="1238821200"/>
        <to usec="0" sec="1238821426"/>
    </anomaly>
    <anomaly type="suspicious" value="0.611571,0.815545,999,0 0 0 0 0 0 1 0 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="202.176.9.54" src_port="53"/>
        </slice>
        <from usec="0" sec="1238821200"/>
        <to usec="0" sec="1238821426"/>
    </anomaly>
    <anomaly type="suspicious" value="0.709747,0.826899,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="140.85.241.106" dst_port="25"/>
        </slice>
        <from usec="0" sec="1238821200"/>
        <to usec="0" sec="1238821426"/>
    </anomaly>
    <anomaly type="suspicious" value="0.611571,0.815545,999,0 0 0 0 0 0 1 0 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="140.85.9.124" src_port="53"/>
        </slice>
        <from usec="0" sec="1238821200"/>
        <to usec="0" sec="1238821426"/>
    </anomaly>
    <anomaly type="suspicious" value="0.826484,0.867281,999,0 0 0 1 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_ip="202.176.13.92"/>
            <filter dst_ip="202.176.6.193"/>
        </slice>
        <from usec="0" sec="1238821230"/>
        <to usec="0" sec="1238821913"/>
    </anomaly>
    <anomaly type="suspicious" value="0.709747,0.826899,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="202.176.6.193" src_port="8582" dst_port="53"/>
        </slice>
        <from usec="0" sec="1238821200"/>
        <to usec="0" sec="1238821426"/>
    </anomaly>
    <anomaly type="suspicious" value="0.709747,0.826899,999,0 0 0 0 0 0 1 1 1 0 0 0,poscaUDP">
        <slice>
            <filter src_ip="215.8.226.94" dst_ip="173.171.76.66"/>
            <filter src_ip="215.8.224.81" dst_ip="173.171.77.13" src_port="53"/>
            <filter src_ip="215.8.224.81" dst_ip="173.171.76.66" src_port="53"/>
            <filter src_ip="215.8.226.94" dst_ip="173.171.77.13" src_port="53"/>
        </slice>
        <from usec="0" sec="1238821200"/>
        <to usec="0" sec="1238822056"/>
    </anomaly>
    <anomaly type="suspicious" value="0.591285,0.805481,020,0 0 0 0 0 0 1 1 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="40.180.150.235"/>
        </slice>
        <from usec="0" sec="1238821380"/>
        <to usec="0" sec="1238821471"/>
    </anomaly>
    <anomaly type="suspicious" value="0.631848,0.835802,999,0 0 0 1 0 0 1 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="43.158.94.21" dst_ip="171.234.99.86" dst_port="57619"/>
        </slice>
        <from usec="0" sec="1238821202"/>
        <to usec="0" sec="1238821934"/>
    </anomaly>
    <anomaly type="suspicious" value="0.709747,0.826899,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="171.234.128.80" src_port="8582" dst_port="53"/>
        </slice>
        <from usec="0" sec="1238821380"/>
        <to usec="0" sec="1238821471"/>
    </anomaly>
    <anomaly type="suspicious" value="0.615335,0.805231,999,1 0 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="164.157.35.98" src_port="53"/>
        </slice>
        <from usec="0" sec="1238821246"/>
        <to usec="0" sec="1238822092"/>
    </anomaly>
    <anomaly type="suspicious" value="0.591285,0.805481,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="173.171.76.66" dst_port="53"/>
            <filter dst_ip="195.18.90.20" dst_port="53"/>
            <filter src_ip="215.8.224.81" dst_ip="173.171.76.66" src_port="53"/>
            <filter src_ip="215.8.226.94" dst_ip="173.171.76.66" src_port="53"/>
        </slice>
        <from usec="0" sec="1238821200"/>
        <to usec="0" sec="1238821966"/>
    </anomaly>
    <anomaly type="suspicious" value="0.615335,0.805231,503,1 0 0 0 0 0 1 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="171.234.16.10" dst_ip="201.105.0.7" dst_port="80"/>
        </slice>
        <from usec="0" sec="1238821566"/>
        <to usec="0" sec="1238822011"/>
    </anomaly>
    <anomaly type="suspicious" value="0.709747,0.826899,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="202.176.6.203" src_port="8582" dst_port="53"/>
        </slice>
        <from usec="0" sec="1238821380"/>
        <to usec="0" sec="1238822011"/>
    </anomaly>
    <anomaly type="suspicious" value="0.709747,0.826899,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="202.176.6.192" src_port="8582" dst_port="53"/>
        </slice>
        <from usec="0" sec="1238821380"/>
        <to usec="0" sec="1238821426"/>
    </anomaly>
    <anomaly type="suspicious" value="0.709747,0.826899,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="202.176.0.34" dst_port="53"/>
        </slice>
        <from usec="0" sec="1238821200"/>
        <to usec="0" sec="1238821246"/>
    </anomaly>
    <anomaly type="suspicious" value="0.591285,0.805481,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="139.36.172.147" dst_port="53"/>
        </slice>
        <from usec="0" sec="1238821200"/>
        <to usec="0" sec="1238821246"/>
    </anomaly>
    <anomaly type="suspicious" value="0.591285,0.805481,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="171.234.191.13" dst_port="53"/>
        </slice>
        <from usec="0" sec="1238821200"/>
        <to usec="0" sec="1238821246"/>
    </anomaly>
    <anomaly type="suspicious" value="0.591285,0.805481,999,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="168.108.54.147" dst_port="10687"/>
        </slice>
        <from usec="0" sec="1238821200"/>
        <to usec="0" sec="1238821246"/>
    </anomaly>
    <anomaly type="suspicious" value="0.709747,0.826899,020,0 0 0 0 0 0 1 1 1 0 0 0,ttl_error">
        <slice>
            <filter src_ip="202.176.13.66"/>
        </slice>
        <from usec="0" sec="1238821380"/>
        <to usec="0" sec="1238821426"/>
    </anomaly>
    <anomaly type="suspicious" value="0.709747,0.826899,020,0 0 0 0 0 0 1 1 1 0 0 0,ttl_error">
        <slice>
            <filter src_ip="140.166.212.155"/>
        </slice>
        <from usec="0" sec="1238821380"/>
        <to usec="0" sec="1238821426"/>
    </anomaly>
    <anomaly type="suspicious" value="0.709747,0.826899,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="195.2.157.157" src_port="6667"/>
        </slice>
        <from usec="0" sec="1238821380"/>
        <to usec="0" sec="1238821426"/>
    </anomaly>
    <anomaly type="suspicious" value="0.709747,0.826899,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="139.36.144.241" dst_port="53"/>
        </slice>
        <from usec="0" sec="1238821380"/>
        <to usec="0" sec="1238821426"/>
    </anomaly>
    <anomaly type="suspicious" value="0.709747,0.826899,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="139.36.172.147" dst_port="53"/>
        </slice>
        <from usec="0" sec="1238821380"/>
        <to usec="0" sec="1238821426"/>
    </anomaly>
    <anomaly type="suspicious" value="0.709747,0.826899,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="171.234.191.13" dst_port="53"/>
        </slice>
        <from usec="0" sec="1238821380"/>
        <to usec="0" sec="1238821426"/>
    </anomaly>
    <anomaly type="suspicious" value="0.709747,0.826899,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="171.234.190.50" dst_port="53"/>
        </slice>
        <from usec="0" sec="1238821380"/>
        <to usec="0" sec="1238821426"/>
    </anomaly>
    <anomaly type="suspicious" value="0.709747,0.826899,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmpla">
        <slice>
            <filter src_ip="202.176.6.203" dst_ip="123.227.116.87" src_port="3127"/>
            <filter src_ip="202.176.6.203" dst_ip="22.80.54.183" src_port="3127"/>
        </slice>
        <from usec="0" sec="1238821380"/>
        <to usec="0" sec="1238821426"/>
    </anomaly>
    <anomaly type="suspicious" value="0.709747,0.826899,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="202.176.13.72" src_port="16881"/>
        </slice>
        <from usec="0" sec="1238821380"/>
        <to usec="0" sec="1238821426"/>
    </anomaly>
    <anomaly type="suspicious" value="0.591285,0.805481,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="203.12.30.17" dst_port="53"/>
        </slice>
        <from usec="0" sec="1238821380"/>
        <to usec="0" sec="1238821426"/>
    </anomaly>
    <anomaly type="suspicious" value="0.709747,0.826899,010,0 0 0 0 0 0 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="220.79.45.57" src_port="80"/>
        </slice>
        <from usec="0" sec="1238821380"/>
        <to usec="0" sec="1238821426"/>
    </anomaly>
    <anomaly type="suspicious" value="0.709747,0.826899,010,0 0 0 0 0 0 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="80.123.118.234" src_port="80"/>
        </slice>
        <from usec="0" sec="1238821380"/>
        <to usec="0" sec="1238821426"/>
    </anomaly>
    <anomaly type="suspicious" value="0.709747,0.826899,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="203.12.31.79" dst_port="53"/>
        </slice>
        <from usec="0" sec="1238821380"/>
        <to usec="0" sec="1238821426"/>
    </anomaly>
    <anomaly type="suspicious" value="0.709747,0.826899,010,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="20.0.199.104" src_port="6005" dst_port="3072"/>
            <filter src_ip="20.0.199.104" src_port="6005" dst_port="1024"/>
        </slice>
        <from usec="0" sec="1238821380"/>
        <to usec="0" sec="1238821426"/>
    </anomaly>
    <anomaly type="suspicious" value="0.709747,0.826899,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="140.85.110.146" src_port="3072"/>
        </slice>
        <from usec="0" sec="1238821380"/>
        <to usec="0" sec="1238821426"/>
    </anomaly>
    <anomaly type="suspicious" value="0.709747,0.826899,010,0 0 0 0 0 0 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="36.17.191.75" src_port="80"/>
        </slice>
        <from usec="0" sec="1238821380"/>
        <to usec="0" sec="1238821426"/>
    </anomaly>
    <anomaly type="suspicious" value="0.709747,0.826899,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="202.176.14.87" src_port="5053" dst_port="53"/>
        </slice>
        <from usec="0" sec="1238821200"/>
        <to usec="0" sec="1238821426"/>
    </anomaly>
    <anomaly type="suspicious" value="0.709747,0.826899,010,0 0 0 0 0 0 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="37.70.126.216" src_port="80"/>
        </slice>
        <from usec="0" sec="1238821380"/>
        <to usec="0" sec="1238821426"/>
    </anomaly>
    <anomaly type="suspicious" value="0.709747,0.826899,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="7.20.200.190" src_port="1040" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1238821380"/>
        <to usec="0" sec="1238821426"/>
    </anomaly>
    <anomaly type="suspicious" value="0.709747,0.826899,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="220.4.14.235" src_port="2929" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1238821380"/>
        <to usec="0" sec="1238821426"/>
    </anomaly>
    <anomaly type="suspicious" value="0.709747,0.826899,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="220.19.181.128" src_port="1033" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1238821380"/>
        <to usec="0" sec="1238821426"/>
    </anomaly>
    <anomaly type="suspicious" value="0.709747,0.826899,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="84.40.26.176" src_port="2150" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1238821380"/>
        <to usec="0" sec="1238821426"/>
    </anomaly>
    <anomaly type="suspicious" value="0.709747,0.826899,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="203.136.125.22" src_port="1231" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1238821380"/>
        <to usec="0" sec="1238821426"/>
    </anomaly>
    <anomaly type="suspicious" value="0.709747,0.826899,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="36.16.12.88" src_port="1252" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1238821380"/>
        <to usec="0" sec="1238821426"/>
    </anomaly>
    <anomaly type="suspicious" value="0.709747,0.826899,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="80.122.99.129" src_port="1083" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1238821380"/>
        <to usec="0" sec="1238821426"/>
    </anomaly>
    <anomaly type="suspicious" value="0.591285,0.805481,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="173.171.77.13" dst_port="53"/>
            <filter src_ip="215.8.226.94" dst_ip="173.171.77.13" src_port="53"/>
            <filter src_ip="215.8.224.81" dst_ip="173.171.77.13" src_port="53"/>
        </slice>
        <from usec="0" sec="1238821200"/>
        <to usec="0" sec="1238821246"/>
    </anomaly>
    <anomaly type="suspicious" value="0.813929,0.837859,999,1 0 0 0 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter dst_ip="202.176.6.203"/>
            <filter dst_ip="202.176.6.193" dst_port="3128"/>
        </slice>
        <from usec="0" sec="1238821380"/>
        <to usec="0" sec="1238821966"/>
    </anomaly>
    <anomaly type="suspicious" value="0.709747,0.826899,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="139.36.113.80" src_port="53"/>
            <filter src_ip="139.36.113.80" dst_port="53"/>
            <filter src_ip="202.176.14.27" src_port="53"/>
        </slice>
        <from usec="0" sec="1238821380"/>
        <to usec="0" sec="1238822011"/>
    </anomaly>
    <anomaly type="suspicious" value="0.591285,0.805481,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="171.234.191.13" dst_port="53"/>
        </slice>
        <from usec="0" sec="1238822010"/>
        <to usec="0" sec="1238822056"/>
    </anomaly>
    <anomaly type="suspicious" value="0.709747,0.826899,010,0 0 0 0 0 0 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="220.116.92.80" src_port="80"/>
        </slice>
        <from usec="0" sec="1238821200"/>
        <to usec="0" sec="1238821246"/>
    </anomaly>
    <anomaly type="suspicious" value="0.709747,0.826899,020,0 0 0 0 0 0 1 1 1 0 0 0,ntscICec">
        <slice>
            <filter src_ip="4.153.107.154"/>
        </slice>
        <from usec="0" sec="1238821200"/>
        <to usec="0" sec="1238821246"/>
    </anomaly>
    <anomaly type="suspicious" value="0.709747,0.826899,020,0 0 0 0 0 0 1 1 1 0 0 0,ntscICec">
        <slice>
            <filter src_ip="40.180.150.235"/>
        </slice>
        <from usec="0" sec="1238821200"/>
        <to usec="0" sec="1238821246"/>
    </anomaly>
    <anomaly type="suspicious" value="0.709747,0.826899,020,0 0 0 0 0 0 1 1 1 0 0 0,ttl_error">
        <slice>
            <filter src_ip="140.166.212.152"/>
        </slice>
        <from usec="0" sec="1238821380"/>
        <to usec="0" sec="1238821426"/>
    </anomaly>
    <anomaly type="suspicious" value="0.709747,0.826899,020,0 0 0 0 0 0 1 1 1 0 0 0,ttl_error">
        <slice>
            <filter src_ip="202.176.13.2"/>
        </slice>
        <from usec="0" sec="1238821380"/>
        <to usec="0" sec="1238821426"/>
    </anomaly>
    <anomaly type="suspicious" value="0.611571,0.815545,020,0 0 0 0 0 0 1 0 1 0 0 0,ntscICec">
        <slice>
            <filter src_ip="40.180.150.235"/>
        </slice>
        <from usec="0" sec="1238821380"/>
        <to usec="0" sec="1238821471"/>
    </anomaly>
    <anomaly type="suspicious" value="0.591285,0.805481,999,0 0 0 0 0 0 1 1 0 0 0 0,mptmp">
        <slice>
            <filter dst_ip="202.176.6.203" dst_port="3128"/>
            <filter dst_ip="202.176.6.203" dst_port="3124"/>
            <filter dst_ip="202.176.6.193" dst_port="3128"/>
            <filter dst_ip="202.176.6.193" dst_port="3124"/>
        </slice>
        <from usec="0" sec="1238821380"/>
        <to usec="0" sec="1238821966"/>
    </anomaly>
    <anomaly type="suspicious" value="0.813929,0.837859,999,1 0 0 0 0 0 1 1 1 0 0 0,ntscACK">
        <slice>
            <filter src_ip="202.176.6.193" src_port="3128"/>
            <filter src_ip="202.176.6.193" dst_ip="201.69.46.57" src_port="80"/>
        </slice>
        <from usec="0" sec="1238821380"/>
        <to usec="0" sec="1238821720"/>
    </anomaly>
    <anomaly type="suspicious" value="0.709747,0.826899,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="139.36.113.91" dst_port="53"/>
        </slice>
        <from usec="0" sec="1238821380"/>
        <to usec="0" sec="1238821426"/>
    </anomaly>
    <anomaly type="suspicious" value="0.709747,0.826899,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="140.85.241.22" dst_port="53"/>
        </slice>
        <from usec="0" sec="1238821380"/>
        <to usec="0" sec="1238821426"/>
    </anomaly>
    <anomaly type="suspicious" value="0.709747,0.826899,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="140.85.241.21" dst_port="53"/>
        </slice>
        <from usec="0" sec="1238821380"/>
        <to usec="0" sec="1238821426"/>
    </anomaly>
    <anomaly type="suspicious" value="0.709747,0.826899,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="202.176.9.33" dst_port="53"/>
        </slice>
        <from usec="0" sec="1238821380"/>
        <to usec="0" sec="1238821426"/>
    </anomaly>
    <anomaly type="suspicious" value="0.709747,0.826899,503,0 0 0 0 0 0 1 1 1 0 0 0,salphfl">
        <slice>
            <filter src_ip="203.12.35.168" dst_ip="41.86.194.11" dst_port="80"/>
        </slice>
        <from usec="0" sec="1238821380"/>
        <to usec="0" sec="1238822011"/>
    </anomaly>
    <anomaly type="suspicious" value="0.709747,0.826899,010,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="221.52.103.200" src_port="3389"/>
        </slice>
        <from usec="0" sec="1238821380"/>
        <to usec="0" sec="1238821426"/>
    </anomaly>
    <anomaly type="suspicious" value="0.709747,0.826899,011,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="37.82.11.111" src_port="9201"/>
        </slice>
        <from usec="0" sec="1238821380"/>
        <to usec="0" sec="1238821426"/>
    </anomaly>
    <anomaly type="suspicious" value="0.611571,0.815545,999,0 0 0 0 0 0 1 0 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="140.85.241.108" src_port="53"/>
        </slice>
        <from usec="0" sec="1238821380"/>
        <to usec="0" sec="1238821426"/>
    </anomaly>
    <anomaly type="suspicious" value="0.709747,0.826899,999,0 0 0 0 0 0 1 1 1 0 0 0,mptpla">
        <slice>
            <filter src_ip="215.8.224.81" dst_ip="173.171.76.66" src_port="53"/>
            <filter src_ip="215.8.226.94" dst_ip="173.171.76.66" src_port="53"/>
        </slice>
        <from usec="0" sec="1238821380"/>
        <to usec="0" sec="1238821471"/>
    </anomaly>
</admd:annotation>
