<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="anomalous" value="2.143150,2.033640,999,0 0 0 0 0 0 0 0 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="215.66.219.235"/>
        </slice>
        <from usec="0" sec="1241500411"/>
        <to usec="0" sec="1241500457"/>
    </anomaly>
    <anomaly type="anomalous" value="1.956620,1.420370,010,1 1 1 1 1 1 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="214.193.1.250" dst_port="135"/>
        </slice>
        <from usec="0" sec="1241499641"/>
        <to usec="0" sec="1241499902"/>
    </anomaly>
    <anomaly type="anomalous" value="1.164680,1.163700,999,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="170.15.7.81" dst_ip="103.183.118.97" src_port="1194" dst_port="49907"/>
        </slice>
        <from usec="0" sec="1241499806"/>
        <to usec="0" sec="1241499900"/>
    </anomaly>
    <anomaly type="anomalous" value="1.681660,1.397240,503,1 1 1 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="170.15.186.73" dst_ip="70.73.81.145" dst_port="80"/>
            <filter src_ip="170.15.186.73" dst_ip="70.73.81.36" dst_port="80"/>
            <filter src_ip="170.15.186.73" dst_ip="196.195.241.227" dst_port="80"/>
        </slice>
        <from usec="0" sec="1241499799"/>
        <to usec="0" sec="1241499898"/>
    </anomaly>
    <anomaly type="anomalous" value="1.956620,1.420370,010,1 1 1 1 1 1 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="69.245.249.53" src_port="6000" dst_port="445"/>
        </slice>
        <from usec="0" sec="1241500387"/>
        <to usec="0" sec="1241500396"/>
    </anomaly>
    <anomaly type="anomalous" value="1.164680,1.163700,999,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="200.189.170.171" dst_ip="215.66.198.23" src_port="2126" dst_port="1059"/>
        </slice>
        <from usec="0" sec="1241499890"/>
        <to usec="0" sec="1241499891"/>
    </anomaly>
    <anomaly type="anomalous" value="3.116360,2.435320,999,1 1 1 1 1 1 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="215.66.219.235"/>
        </slice>
        <from usec="0" sec="1241499601"/>
        <to usec="0" sec="1241500502"/>
    </anomaly>
    <anomaly type="anomalous" value="1.164680,1.163700,999,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="68.1.238.233" dst_ip="215.66.198.23" src_port="1028" dst_port="1059"/>
        </slice>
        <from usec="0" sec="1241499806"/>
        <to usec="0" sec="1241499902"/>
    </anomaly>
    <anomaly type="anomalous" value="1.967120,1.415320,010,1 1 1 1 1 1 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="200.6.209.186" src_port="6000" dst_port="2967"/>
        </slice>
        <from usec="0" sec="1241499691"/>
        <to usec="0" sec="1241499737"/>
    </anomaly>
    <anomaly type="anomalous" value="1.956620,1.420370,010,1 1 1 1 1 1 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="206.5.38.184" src_port="6000" dst_port="135"/>
        </slice>
        <from usec="0" sec="1241500288"/>
        <to usec="0" sec="1241500314"/>
    </anomaly>
    <anomaly type="anomalous" value="1.524340,1.350620,999,1 0 0 1 1 0 1 1 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="218.218.8.160" src_port="53"/>
            <filter dst_ip="218.218.8.160" dst_port="53"/>
        </slice>
        <from usec="0" sec="1241499601"/>
        <to usec="0" sec="1241500457"/>
    </anomaly>
    <anomaly type="anomalous" value="1.088720,1.063930,999,0 0 0 1 1 1 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="170.15.187.156" dst_port="11481"/>
        </slice>
        <from usec="0" sec="1241499601"/>
        <to usec="0" sec="1241500429"/>
    </anomaly>
    <anomaly type="anomalous" value="1.199790,1.062470,999,1 0 0 1 1 1 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="215.66.198.23" src_port="1059"/>
        </slice>
        <from usec="0" sec="1241499601"/>
        <to usec="0" sec="1241500015"/>
    </anomaly>
    <anomaly type="anomalous" value="1.967120,1.415320,010,1 1 1 1 1 1 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="205.178.154.93" src_port="35388" dst_port="22"/>
        </slice>
        <from usec="0" sec="1241499956"/>
        <to usec="0" sec="1241500059"/>
    </anomaly>
    <anomaly type="anomalous" value="1.088720,1.063930,503,0 0 0 1 1 1 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="170.15.184.19" src_port="80"/>
        </slice>
        <from usec="0" sec="1241499620"/>
        <to usec="0" sec="1241500159"/>
    </anomaly>
    <anomaly type="anomalous" value="1.190720,1.109450,999,1 1 0 1 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="214.163.228.3" src_port="16001"/>
        </slice>
        <from usec="0" sec="1241499601"/>
        <to usec="0" sec="1241500249"/>
    </anomaly>
    <anomaly type="anomalous" value="1.810690,1.361640,503,1 1 1 1 1 0 1 0 0 0 0 0,mptmp">
        <slice>
            <filter dst_ip="215.66.220.67" dst_port="80"/>
            <filter dst_ip="215.66.220.66" dst_port="80"/>
        </slice>
        <from usec="0" sec="1241499603"/>
        <to usec="0" sec="1241500249"/>
    </anomaly>
    <anomaly type="anomalous" value="1.088720,1.063930,503,0 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="134.73.33.106" dst_ip="215.173.86.209" dst_port="80"/>
        </slice>
        <from usec="0" sec="1241500060"/>
        <to usec="0" sec="1241500248"/>
    </anomaly>
    <anomaly type="anomalous" value="1.088720,1.063930,503,0 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="193.5.194.27" dst_ip="170.15.187.97" src_port="80" dst_port="51029"/>
        </slice>
        <from usec="0" sec="1241499601"/>
        <to usec="0" sec="1241499709"/>
    </anomaly>
    <anomaly type="anomalous" value="1.088720,1.063930,503,0 0 0 1 1 1 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="215.66.216.81" dst_ip="213.210.122.74" src_port="80" dst_port="22043"/>
        </slice>
        <from usec="0" sec="1241499686"/>
        <to usec="0" sec="1241499700"/>
    </anomaly>
    <anomaly type="anomalous" value="1.088720,1.063930,999,0 0 0 1 1 1 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="170.15.187.156" src_port="11481"/>
        </slice>
        <from usec="0" sec="1241499601"/>
        <to usec="0" sec="1241499979"/>
    </anomaly>
    <anomaly type="anomalous" value="1.088720,1.063930,503,0 0 0 1 1 1 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="215.66.216.81" dst_ip="222.214.82.196" src_port="80" dst_port="47753"/>
        </slice>
        <from usec="0" sec="1241499799"/>
        <to usec="0" sec="1241499836"/>
    </anomaly>
    <anomaly type="anomalous" value="1.088720,1.063930,503,0 0 0 1 1 1 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="197.221.21.141" dst_ip="170.15.245.244" src_port="80" dst_port="49179"/>
            <filter src_ip="197.221.21.27" dst_ip="170.15.245.244" src_port="80" dst_port="53516"/>
        </slice>
        <from usec="0" sec="1241500227"/>
        <to usec="0" sec="1241500247"/>
    </anomaly>
    <anomaly type="anomalous" value="1.107480,1.057180,999,0 0 0 1 1 1 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="170.15.187.1" src_port="8000"/>
        </slice>
        <from usec="0" sec="1241499601"/>
        <to usec="0" sec="1241500429"/>
    </anomaly>
    <anomaly type="anomalous" value="1.088720,1.063930,503,0 0 0 1 1 1 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="202.7.64.15" dst_ip="134.73.32.114" src_port="80" dst_port="38166"/>
            <filter src_ip="162.10.167.81" dst_ip="134.73.32.114" src_port="80" dst_port="57110"/>
            <filter src_ip="162.10.167.28" dst_ip="134.73.32.114" src_port="80" dst_port="51083"/>
            <filter src_ip="162.10.167.4" dst_ip="134.73.32.114" src_port="80" dst_port="58219"/>
        </slice>
        <from usec="0" sec="1241499602"/>
        <to usec="0" sec="1241499974"/>
    </anomaly>
    <anomaly type="anomalous" value="3.116360,2.435320,999,1 1 1 1 1 1 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="215.66.219.235"/>
        </slice>
        <from usec="0" sec="1241499601"/>
        <to usec="0" sec="1241500502"/>
    </anomaly>
    <anomaly type="anomalous" value="1.182230,1.157530,999,1 1 0 0 0 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="215.66.218.53" dst_ip="34.141.80.125"/>
            <filter src_ip="215.66.218.53" src_port="3128"/>
            <filter dst_ip="34.141.80.125" src_port="3128"/>
        </slice>
        <from usec="0" sec="1241499691"/>
        <to usec="0" sec="1241500367"/>
    </anomaly>
    <anomaly type="anomalous" value="1.216840,1.055710,999,1 0 0 1 1 1 1 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="34.141.80.125" dst_ip="215.66.218.53"/>
            <filter src_ip="34.141.80.125" dst_port="3128"/>
            <filter dst_ip="215.66.218.53" dst_port="3128"/>
            <filter src_ip="34.141.80.125" dst_ip="215.66.218.56" dst_port="3127"/>
        </slice>
        <from usec="0" sec="1241499601"/>
        <to usec="0" sec="1241500421"/>
    </anomaly>
    <anomaly type="anomalous" value="1.383540,1.381330,503,1 0 0 0 0 0 1 1 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="215.66.219.234" dst_port="80"/>
        </slice>
        <from usec="0" sec="1241499601"/>
        <to usec="0" sec="1241500502"/>
    </anomaly>
    <anomaly type="suspicious" value="0.677656,0.977070,999,1 0 0 1 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="128.46.105.171" dst_ip="41.213.117.2" src_port="80"/>
            <filter src_ip="128.46.105.171" src_port="123" dst_port="123"/>
        </slice>
        <from usec="0" sec="1241499601"/>
        <to usec="0" sec="1241500249"/>
    </anomaly>
    <anomaly type="suspicious" value="0.943253,0.982574,999,1 0 0 1 1 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="215.66.219.234"/>
        </slice>
        <from usec="0" sec="1241499601"/>
        <to usec="0" sec="1241500502"/>
    </anomaly>
    <anomaly type="suspicious" value="0.770933,0.991393,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="45.238.98.209" dst_ip="215.66.220.66" src_port="3324" dst_port="80"/>
        </slice>
        <from usec="0" sec="1241499673"/>
        <to usec="0" sec="1241499701"/>
    </anomaly>
    <anomaly type="suspicious" value="0.757761,1.044920,503,0 0 0 0 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="116.20.195.19" dst_ip="170.15.186.106" src_port="80"/>
        </slice>
        <from usec="0" sec="1241499601"/>
        <to usec="0" sec="1241499889"/>
    </anomaly>
    <anomaly type="suspicious" value="0.770933,0.991393,503,0 0 0 1 1 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="134.73.1.68" dst_ip="32.161.32.201" src_port="80"/>
            <filter src_ip="134.73.1.68" dst_ip="41.213.113.42" src_port="80"/>
        </slice>
        <from usec="0" sec="1241499605"/>
        <to usec="0" sec="1241500134"/>
    </anomaly>
    <anomaly type="suspicious" value="0.757761,1.044920,503,0 0 0 0 1 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="205.187.156.155" dst_ip="134.73.198.82" src_port="80"/>
        </slice>
        <from usec="0" sec="1241499601"/>
        <to usec="0" sec="1241500249"/>
    </anomaly>
    <anomaly type="suspicious" value="0.770933,0.991393,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="52.81.62.163" dst_ip="170.15.19.152" src_port="49343" dst_port="80"/>
        </slice>
        <from usec="0" sec="1241499993"/>
        <to usec="0" sec="1241500104"/>
    </anomaly>
    <anomaly type="suspicious" value="0.770933,0.991393,503,0 0 0 1 1 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="215.66.214.16" src_port="80"/>
            <filter src_ip="215.66.214.16" src_port="21"/>
        </slice>
        <from usec="0" sec="1241499601"/>
        <to usec="0" sec="1241500429"/>
    </anomaly>
    <anomaly type="suspicious" value="0.770933,0.991393,503,0 0 0 1 1 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="170.15.245.244" dst_ip="197.221.21.141" src_port="49179" dst_port="80"/>
            <filter src_ip="170.15.245.244" dst_ip="197.221.21.27" src_port="53516" dst_port="80"/>
        </slice>
        <from usec="0" sec="1241500227"/>
        <to usec="0" sec="1241500247"/>
    </anomaly>
    <anomaly type="suspicious" value="0.892185,1.052070,503,0 0 0 1 0 1 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="116.20.195.19" dst_ip="170.15.186.106" src_port="80"/>
        </slice>
        <from usec="0" sec="1241499601"/>
        <to usec="0" sec="1241499889"/>
    </anomaly>
    <anomaly type="suspicious" value="0.892185,1.052070,503,0 0 0 1 0 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="205.187.156.155" dst_ip="134.73.198.82" src_port="80"/>
        </slice>
        <from usec="0" sec="1241499601"/>
        <to usec="0" sec="1241500249"/>
    </anomaly>
    <anomaly type="suspicious" value="1.296190,1.342450,999,0 0 0 1 0 0 1 1 0 0 0 0,mptmp">
        <slice>
            <filter dst_port="53"/>
            <filter src_ip="193.59.154.241" dst_ip="172.204.188.224"/>
            <filter src_ip="193.59.153.201" dst_ip="172.204.189.114"/>
            <filter src_ip="193.59.153.201" src_port="53"/>
            <filter dst_ip="172.204.188.224" src_port="53"/>
            <filter src_ip="193.59.154.241" dst_ip="172.204.189.114" src_port="53"/>
        </slice>
        <from usec="0" sec="1241499601"/>
        <to usec="0" sec="1241500457"/>
    </anomaly>
    <anomaly type="suspicious" value="0.707402,0.969719,503,1 0 0 1 0 0 1 0 0 0 0 0,heavy_hitter">
        <slice>
            <filter src_ip="170.15.19.152" dst_ip="71.20.88.139" src_port="80"/>
        </slice>
        <from usec="0" sec="1241499601"/>
        <to usec="0" sec="1241499979"/>
    </anomaly>
    <anomaly type="suspicious" value="1.296190,1.342450,010,0 0 0 1 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="172.204.7.92" src_port="25"/>
        </slice>
        <from usec="0" sec="1241499601"/>
        <to usec="0" sec="1241500244"/>
    </anomaly>
    <anomaly type="suspicious" value="1.296190,1.342450,999,0 0 0 1 0 0 1 1 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="34.141.80.125" dst_ip="215.66.218.57"/>
            <filter dst_ip="215.66.218.57" dst_port="3124"/>
            <filter src_ip="34.141.80.125" dst_ip="215.66.218.52" dst_port="3124"/>
        </slice>
        <from usec="0" sec="1241499601"/>
        <to usec="0" sec="1241500248"/>
    </anomaly>
    <anomaly type="suspicious" value="0.693025,1.024380,020,1 0 0 0 0 0 1 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="8.152.180.140"/>
        </slice>
        <from usec="0" sec="1241500141"/>
        <to usec="0" sec="1241500187"/>
    </anomaly>
    <anomaly type="suspicious" value="0.797206,0.984149,999,0 0 0 1 1 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="214.163.228.3" dst_port="16001"/>
            <filter dst_ip="214.163.228.3" dst_port="3466"/>
        </slice>
        <from usec="0" sec="1241499601"/>
        <to usec="0" sec="1241500421"/>
    </anomaly>
    <anomaly type="suspicious" value="1.288400,1.382450,999,0 0 0 0 0 0 1 1 0 0 0 0,rflatDNS">
        <slice>
            <filter src_ip="193.59.153.201" dst_ip="172.204.189.114"/>
            <filter src_ip="193.59.154.241" dst_ip="172.204.189.114"/>
            <filter dst_ip="172.204.189.114" src_port="53"/>
            <filter src_ip="193.59.153.201" dst_ip="172.204.188.224" src_port="53"/>
            <filter src_ip="193.59.154.241" dst_ip="172.204.188.224" src_port="53"/>
        </slice>
        <from usec="0" sec="1241499601"/>
        <to usec="0" sec="1241500187"/>
    </anomaly>
    <anomaly type="suspicious" value="1.288400,1.382450,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="170.15.104.200" src_port="25576"/>
        </slice>
        <from usec="0" sec="1241500051"/>
        <to usec="0" sec="1241500097"/>
    </anomaly>
</admd:annotation>
