<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="anomalous" value="1.233450,1.173420,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="204.29.97.25" dst_ip="146.59.49.5" src_port="80" dst_port="3184"/>
        </slice>
        <from usec="0" sec="1244264807"/>
        <to usec="0" sec="1244264818"/>
    </anomaly>
    <anomaly type="anomalous" value="1.762840,1.512300,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="58.97.178.206" dst_port="8080"/>
        </slice>
        <from usec="0" sec="1244264807"/>
        <to usec="0" sec="1244264820"/>
    </anomaly>
    <anomaly type="anomalous" value="1.685760,1.308020,503,1 1 0 1 1 1 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="196.5.156.230" src_port="80"/>
        </slice>
        <from usec="0" sec="1244264401"/>
        <to usec="0" sec="1244265139"/>
    </anomaly>
    <anomaly type="anomalous" value="1.762840,1.512300,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="61.136.38.64" dst_port="25"/>
        </slice>
        <from usec="0" sec="1244265254"/>
        <to usec="0" sec="1244265266"/>
    </anomaly>
    <anomaly type="anomalous" value="1.233450,1.173420,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="199.46.190.240" dst_port="139"/>
            <filter src_ip="199.46.190.240" dst_port="445"/>
        </slice>
        <from usec="0" sec="1244265006"/>
        <to usec="0" sec="1244265301"/>
    </anomaly>
    <anomaly type="anomalous" value="1.233450,1.173420,011,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="213.231.147.85" src_port="1433" dst_port="6000"/>
        </slice>
        <from usec="0" sec="1244264542"/>
        <to usec="0" sec="1244264544"/>
    </anomaly>
    <anomaly type="anomalous" value="2.156540,1.628780,010,1 1 1 1 1 1 1 1 1 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="210.19.140.7" src_port="6000" dst_port="445"/>
        </slice>
        <from usec="0" sec="1244264761"/>
        <to usec="0" sec="1244264852"/>
    </anomaly>
    <anomaly type="anomalous" value="1.762840,1.512300,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="58.109.169.141" dst_port="25"/>
        </slice>
        <from usec="0" sec="1244264956"/>
        <to usec="0" sec="1244264969"/>
    </anomaly>
    <anomaly type="anomalous" value="2.156540,1.628780,010,1 1 1 1 1 1 1 1 1 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="213.231.147.85" src_port="6000" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1244264536"/>
        <to usec="0" sec="1244264582"/>
    </anomaly>
    <anomaly type="anomalous" value="1.381130,1.134450,503,1 0 0 1 1 1 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="164.124.11.77" dst_ip="6.29.152.101" src_port="80"/>
            <filter src_ip="164.124.11.77" dst_ip="58.134.22.0" src_port="80"/>
        </slice>
        <from usec="0" sec="1244264404"/>
        <to usec="0" sec="1244264689"/>
    </anomaly>
    <anomaly type="anomalous" value="1.685760,1.308020,503,1 1 0 1 1 1 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="196.5.156.230" dst_port="80"/>
        </slice>
        <from usec="0" sec="1244264401"/>
        <to usec="0" sec="1244265170"/>
    </anomaly>
    <anomaly type="anomalous" value="1.284850,1.110520,503,0 0 0 1 1 1 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="196.5.153.55" dst_port="80"/>
        </slice>
        <from usec="0" sec="1244264401"/>
        <to usec="0" sec="1244264869"/>
    </anomaly>
    <anomaly type="anomalous" value="1.459510,1.148410,999,1 0 0 1 1 1 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="197.227.212.122"/>
        </slice>
        <from usec="0" sec="1244264401"/>
        <to usec="0" sec="1244265301"/>
    </anomaly>
    <anomaly type="anomalous" value="1.284850,1.110520,503,0 0 0 1 1 1 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="146.59.48.34" src_port="80"/>
        </slice>
        <from usec="0" sec="1244264401"/>
        <to usec="0" sec="1244265180"/>
    </anomaly>
    <anomaly type="anomalous" value="1.284850,1.110520,503,0 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="161.250.214.195" dst_ip="9.129.225.160" src_port="80"/>
        </slice>
        <from usec="0" sec="1244264409"/>
        <to usec="0" sec="1244265206"/>
    </anomaly>
    <anomaly type="anomalous" value="1.284850,1.110520,503,0 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="156.60.49.107" dst_ip="196.5.158.14" src_port="80" dst_port="4426"/>
        </slice>
        <from usec="0" sec="1244264542"/>
        <to usec="0" sec="1244264643"/>
    </anomaly>
    <anomaly type="anomalous" value="1.284850,1.110520,503,0 0 0 1 1 1 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="196.5.23.96" src_port="80"/>
        </slice>
        <from usec="0" sec="1244264401"/>
        <to usec="0" sec="1244264779"/>
    </anomaly>
    <anomaly type="anomalous" value="1.284850,1.110520,503,0 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="156.60.48.19" dst_ip="196.5.158.14" src_port="80" dst_port="4482"/>
        </slice>
        <from usec="0" sec="1244264656"/>
        <to usec="0" sec="1244264719"/>
    </anomaly>
    <anomaly type="anomalous" value="1.284850,1.110520,503,0 0 0 1 1 1 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="196.5.153.55" src_port="80"/>
        </slice>
        <from usec="0" sec="1244264401"/>
        <to usec="0" sec="1244264869"/>
    </anomaly>
    <anomaly type="anomalous" value="1.069840,1.035170,999,0 0 0 1 1 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="5.195.83.159" dst_ip="197.227.213.61" dst_port="3128"/>
            <filter src_ip="5.195.83.159" dst_ip="197.227.213.60" dst_port="3128"/>
            <filter src_ip="5.195.83.159" dst_ip="197.227.213.60" dst_port="3127"/>
        </slice>
        <from usec="0" sec="1244264439"/>
        <to usec="0" sec="1244264951"/>
    </anomaly>
    <anomaly type="anomalous" value="1.284850,1.110520,503,0 0 0 1 1 1 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="156.60.49.123" dst_ip="146.59.49.169" src_port="80" dst_port="2852"/>
            <filter src_ip="156.60.49.123" dst_ip="196.5.158.14" src_port="80" dst_port="4572"/>
        </slice>
        <from usec="0" sec="1244264839"/>
        <to usec="0" sec="1244264959"/>
    </anomaly>
    <anomaly type="anomalous" value="1.284850,1.110520,503,0 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="81.165.228.243" dst_ip="161.253.85.1" src_port="80" dst_port="60987"/>
        </slice>
        <from usec="0" sec="1244265208"/>
        <to usec="0" sec="1244265211"/>
    </anomaly>
    <anomaly type="anomalous" value="1.381130,1.134450,503,1 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="156.60.48.34" dst_ip="196.5.158.14" src_port="80" dst_port="4635"/>
        </slice>
        <from usec="0" sec="1244264924"/>
        <to usec="0" sec="1244265009"/>
    </anomaly>
    <anomaly type="anomalous" value="1.284850,1.110520,503,0 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="156.60.48.51" dst_ip="196.5.158.14" src_port="80" dst_port="4741"/>
        </slice>
        <from usec="0" sec="1244265130"/>
        <to usec="0" sec="1244265211"/>
    </anomaly>
    <anomaly type="anomalous" value="1.284850,1.110520,020,0 0 0 1 1 1 0 0 0 0 0 0,ttl_error">
        <slice>
            <filter dst_ip="196.220.145.143"/>
        </slice>
        <from usec="0" sec="1244265167"/>
        <to usec="0" sec="1244265169"/>
    </anomaly>
    <anomaly type="anomalous" value="1.284850,1.110520,503,0 0 0 1 1 1 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="80.160.8.189" dst_ip="196.5.154.51" src_port="80"/>
            <filter src_ip="80.160.8.189" dst_ip="146.59.237.194" src_port="80"/>
        </slice>
        <from usec="0" sec="1244264423"/>
        <to usec="0" sec="1244264959"/>
    </anomaly>
    <anomaly type="anomalous" value="1.284850,1.110520,999,0 0 0 1 1 1 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="2.112.230.58" dst_ip="196.10.84.37" dst_port="25"/>
        </slice>
        <from usec="0" sec="1244264458"/>
        <to usec="0" sec="1244265117"/>
    </anomaly>
    <anomaly type="anomalous" value="1.920270,1.539250,999,1 1 1 1 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_ip="200.17.103.156" src_port="53"/>
            <filter dst_ip="200.17.103.156" dst_port="53"/>
        </slice>
        <from usec="0" sec="1244264401"/>
        <to usec="0" sec="1244265267"/>
    </anomaly>
    <anomaly type="anomalous" value="2.156540,1.628780,999,1 1 1 1 1 1 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="197.227.212.123"/>
        </slice>
        <from usec="0" sec="1244264401"/>
        <to usec="0" sec="1244265301"/>
    </anomaly>
    <anomaly type="anomalous" value="2.156540,1.628780,999,1 1 1 1 1 1 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="197.227.212.123"/>
        </slice>
        <from usec="0" sec="1244264401"/>
        <to usec="0" sec="1244265301"/>
    </anomaly>
    <anomaly type="anomalous" value="1.274320,1.075710,999,1 0 0 1 1 0 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="197.227.212.122"/>
        </slice>
        <from usec="0" sec="1244264401"/>
        <to usec="0" sec="1244265301"/>
    </anomaly>
    <anomaly type="suspicious" value="0.802765,1.012220,999,0 0 0 0 0 0 0 0 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="200.17.103.156" src_port="53" dst_port="53"/>
        </slice>
        <from usec="0" sec="1244264806"/>
        <to usec="0" sec="1244264852"/>
    </anomaly>
    <anomaly type="suspicious" value="0.766235,0.976204,999,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="164.124.148.166" dst_port="7791" proto="tcp"/>
        </slice>
        <from usec="0" sec="1244264961"/>
        <to usec="0" sec="1244264963"/>
    </anomaly>
    <anomaly type="suspicious" value="0.766235,0.976204,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="164.124.22.0" dst_ip="219.216.169.169" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1244265039"/>
        <to usec="0" sec="1244265041"/>
    </anomaly>
    <anomaly type="suspicious" value="0.766235,0.976204,503,1 0 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="164.124.40.230"/>
        </slice>
        <from usec="0" sec="1244264961"/>
        <to usec="0" sec="1244264969"/>
    </anomaly>
    <anomaly type="suspicious" value="0.766235,0.976204,020,1 0 0 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="197.227.218.189"/>
        </slice>
        <from usec="0" sec="1244264409"/>
        <to usec="0" sec="1244264414"/>
    </anomaly>
    <anomaly type="suspicious" value="0.766235,0.976204,503,1 0 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="164.124.180.119" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1244264553"/>
        <to usec="0" sec="1244264968"/>
    </anomaly>
    <anomaly type="suspicious" value="0.766235,0.976204,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="196.5.158.14" dst_ip="156.60.49.77" src_port="4796" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1244265278"/>
        <to usec="0" sec="1244265280"/>
    </anomaly>
    <anomaly type="suspicious" value="0.766235,0.976204,999,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="12.103.71.199" dst_ip="197.227.198.66" src_port="61546" dst_port="1056" proto="udp"/>
        </slice>
        <from usec="0" sec="1244264960"/>
        <to usec="0" sec="1244264968"/>
    </anomaly>
    <anomaly type="suspicious" value="0.766235,0.976204,503,1 0 0 0 0 0 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="164.124.235.164" dst_ip="194.133.55.144" src_port="3631" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1244264553"/>
        <to usec="0" sec="1244264555"/>
    </anomaly>
    <anomaly type="suspicious" value="0.766235,0.976204,503,1 0 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="146.59.49.10"/>
        </slice>
        <from usec="0" sec="1244265263"/>
        <to usec="0" sec="1244265265"/>
    </anomaly>
    <anomaly type="suspicious" value="0.766235,0.976204,503,1 0 0 0 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="146.59.175.177"/>
        </slice>
        <from usec="0" sec="1244265168"/>
        <to usec="0" sec="1244265170"/>
    </anomaly>
    <anomaly type="suspicious" value="0.766235,0.976204,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="29.101.52.6" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1244264486"/>
        <to usec="0" sec="1244264488"/>
    </anomaly>
    <anomaly type="suspicious" value="0.766235,0.976204,999,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="13.4.50.60"/>
        </slice>
        <from usec="0" sec="1244264487"/>
        <to usec="0" sec="1244264490"/>
    </anomaly>
    <anomaly type="suspicious" value="0.766235,0.976204,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="0.179.80.63"/>
        </slice>
        <from usec="0" sec="1244264663"/>
        <to usec="0" sec="1244264665"/>
    </anomaly>
    <anomaly type="suspicious" value="0.766235,0.976204,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="128.8.220.231" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1244264511"/>
        <to usec="0" sec="1244264515"/>
    </anomaly>
    <anomaly type="suspicious" value="0.766235,0.976204,503,1 0 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="161.235.210.5"/>
        </slice>
        <from usec="0" sec="1244264965"/>
        <to usec="0" sec="1244264967"/>
    </anomaly>
    <anomaly type="suspicious" value="0.829224,0.974485,503,0 0 0 1 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="156.60.49.113"/>
        </slice>
        <from usec="0" sec="1244264745"/>
        <to usec="0" sec="1244264779"/>
    </anomaly>
    <anomaly type="suspicious" value="0.829224,0.974485,503,0 0 0 1 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="81.165.228.225"/>
        </slice>
        <from usec="0" sec="1244264768"/>
        <to usec="0" sec="1244264770"/>
    </anomaly>
    <anomaly type="suspicious" value="0.829224,0.974485,503,0 0 0 1 0 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="146.59.175.184"/>
        </slice>
        <from usec="0" sec="1244264416"/>
        <to usec="0" sec="1244265130"/>
    </anomaly>
    <anomaly type="suspicious" value="0.704120,0.927106,503,1 0 0 0 0 0 1 1 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="146.59.214.96" src_port="80"/>
            <filter src_ip="156.52.1.125" dst_ip="146.59.214.96" dst_port="80"/>
        </slice>
        <from usec="0" sec="1244264401"/>
        <to usec="0" sec="1244265117"/>
    </anomaly>
    <anomaly type="suspicious" value="0.743707,0.964958,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="164.124.128.240" src_port="53"/>
            <filter src_ip="164.124.128.240" dst_port="53"/>
        </slice>
        <from usec="0" sec="1244264401"/>
        <to usec="0" sec="1244264807"/>
    </anomaly>
    <anomaly type="suspicious" value="0.954081,0.990703,999,0 0 0 1 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_ip="208.104.115.27" dst_ip="197.227.213.60"/>
            <filter src_ip="208.104.115.27" dst_ip="197.227.213.48"/>
            <filter src_ip="208.104.115.27" dst_port="3124"/>
            <filter dst_ip="197.227.213.60" dst_port="3124"/>
            <filter dst_ip="197.227.213.48" dst_port="3124"/>
        </slice>
        <from usec="0" sec="1244264401"/>
        <to usec="0" sec="1244264959"/>
    </anomaly>
    <anomaly type="suspicious" value="0.743707,0.964958,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscACKt">
        <slice>
            <filter src_ip="196.10.84.131"/>
        </slice>
        <from usec="0" sec="1244264401"/>
        <to usec="0" sec="1244264852"/>
    </anomaly>
    <anomaly type="suspicious" value="0.743707,0.964958,999,0 0 0 0 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_ip="146.59.175.222" src_port="6881"/>
            <filter src_ip="197.227.213.49" src_port="6881"/>
        </slice>
        <from usec="0" sec="1244264401"/>
        <to usec="0" sec="1244265212"/>
    </anomaly>
    <anomaly type="suspicious" value="0.899875,0.992395,010,1 0 0 0 0 0 1 1 1 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="61.143.208.230" dst_port="25"/>
        </slice>
        <from usec="0" sec="1244264536"/>
        <to usec="0" sec="1244264582"/>
    </anomaly>
    <anomaly type="suspicious" value="0.743707,0.964958,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="197.227.220.49" src_port="39733"/>
        </slice>
        <from usec="0" sec="1244264401"/>
        <to usec="0" sec="1244264807"/>
    </anomaly>
    <anomaly type="suspicious" value="0.743707,0.964958,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="197.227.213.48" src_port="6881"/>
        </slice>
        <from usec="0" sec="1244264536"/>
        <to usec="0" sec="1244264807"/>
    </anomaly>
    <anomaly type="suspicious" value="0.743707,0.964958,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="161.235.221.161" src_port="3072"/>
        </slice>
        <from usec="0" sec="1244264536"/>
        <to usec="0" sec="1244264807"/>
    </anomaly>
    <anomaly type="suspicious" value="0.669894,0.933482,010,1 0 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="130.5.169.2" dst_port="23"/>
        </slice>
        <from usec="0" sec="1244264806"/>
        <to usec="0" sec="1244264852"/>
    </anomaly>
    <anomaly type="suspicious" value="0.743707,0.964958,503,0 0 0 0 0 0 1 1 1 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="1.188.64.65" dst_ip="197.227.218.57" dst_port="80"/>
        </slice>
        <from usec="0" sec="1244264401"/>
        <to usec="0" sec="1244264807"/>
    </anomaly>
    <anomaly type="suspicious" value="0.743707,0.964958,999,0 0 0 0 0 0 1 1 1 0 0 0,mptpla">
        <slice>
            <filter dst_ip="208.26.131.222"/>
        </slice>
        <from usec="0" sec="1244264401"/>
        <to usec="0" sec="1244264447"/>
    </anomaly>
    <anomaly type="suspicious" value="0.743707,0.964958,999,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="197.227.213.49" dst_port="6881"/>
        </slice>
        <from usec="0" sec="1244264401"/>
        <to usec="0" sec="1244264447"/>
    </anomaly>
    <anomaly type="suspicious" value="0.743707,0.964958,999,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="196.5.158.14" dst_port="13761"/>
        </slice>
        <from usec="0" sec="1244264401"/>
        <to usec="0" sec="1244264447"/>
    </anomaly>
    <anomaly type="suspicious" value="0.743707,0.964958,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="146.59.141.48" dst_port="53"/>
        </slice>
        <from usec="0" sec="1244264536"/>
        <to usec="0" sec="1244264582"/>
    </anomaly>
    <anomaly type="suspicious" value="0.743707,0.964958,999,0 0 0 0 0 0 1 1 1 0 0 0,heavy_hitter">
        <slice>
            <filter src_ip="213.131.164.247" dst_ip="197.227.213.61" dst_port="3127"/>
        </slice>
        <from usec="0" sec="1244264536"/>
        <to usec="0" sec="1244264582"/>
    </anomaly>
    <anomaly type="suspicious" value="0.743707,0.964958,999,0 0 0 0 0 0 1 1 1 0 0 0,heavy_hitter">
        <slice>
            <filter src_ip="213.131.164.247" dst_ip="197.227.213.61" dst_port="3128"/>
        </slice>
        <from usec="0" sec="1244264536"/>
        <to usec="0" sec="1244264582"/>
    </anomaly>
    <anomaly type="suspicious" value="0.743707,0.964958,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="164.124.54.203" dst_port="53"/>
        </slice>
        <from usec="0" sec="1244264536"/>
        <to usec="0" sec="1244264807"/>
    </anomaly>
    <anomaly type="suspicious" value="0.743707,0.964958,999,0 0 0 0 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_ip="197.227.213.60" dst_ip="208.104.115.27"/>
            <filter src_ip="197.227.213.60" src_port="6881"/>
            <filter src_ip="197.227.213.60" src_port="3128"/>
            <filter dst_ip="208.104.115.27" src_port="3128"/>
        </slice>
        <from usec="0" sec="1244264401"/>
        <to usec="0" sec="1244264852"/>
    </anomaly>
    <anomaly type="suspicious" value="0.743707,0.964958,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="146.59.175.222" src_port="6881"/>
        </slice>
        <from usec="0" sec="1244264536"/>
        <to usec="0" sec="1244264807"/>
    </anomaly>
    <anomaly type="suspicious" value="0.743707,0.964958,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmpla">
        <slice>
            <filter src_ip="208.104.115.27" dst_ip="197.227.213.61" dst_port="3128"/>
            <filter src_ip="208.104.115.27" dst_ip="197.227.213.60" dst_port="3128"/>
            <filter src_ip="208.104.115.27" dst_ip="197.227.213.48" dst_port="3128"/>
        </slice>
        <from usec="0" sec="1244264536"/>
        <to usec="0" sec="1244264807"/>
    </anomaly>
    <anomaly type="suspicious" value="0.743707,0.964958,020,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPICdurp">
        <slice>
            <filter dst_ip="85.185.26.171"/>
        </slice>
        <from usec="0" sec="1244264401"/>
        <to usec="0" sec="1244264447"/>
    </anomaly>
    <anomaly type="suspicious" value="0.743707,0.964958,020,0 0 0 0 0 0 1 1 1 0 0 0,ttl_error">
        <slice>
            <filter src_ip="197.227.220.232"/>
        </slice>
        <from usec="0" sec="1244264401"/>
        <to usec="0" sec="1244264807"/>
    </anomaly>
    <anomaly type="suspicious" value="0.743707,0.964958,020,0 0 0 0 0 0 1 1 1 0 0 0,ttl_error">
        <slice>
            <filter src_ip="197.227.220.140"/>
        </slice>
        <from usec="0" sec="1244264536"/>
        <to usec="0" sec="1244264807"/>
    </anomaly>
    <anomaly type="suspicious" value="0.743707,0.964958,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="144.172.166.225" src_port="36141"/>
        </slice>
        <from usec="0" sec="1244264536"/>
        <to usec="0" sec="1244264807"/>
    </anomaly>
    <anomaly type="suspicious" value="0.743707,0.964958,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="146.59.175.220" src_port="6881"/>
        </slice>
        <from usec="0" sec="1244264536"/>
        <to usec="0" sec="1244264807"/>
    </anomaly>
    <anomaly type="suspicious" value="0.743707,0.964958,999,0 0 0 0 0 0 1 1 1 0 0 0,alphfl">
        <slice>
            <filter src_ip="213.131.164.247" dst_ip="197.227.213.61" dst_port="3124"/>
        </slice>
        <from usec="0" sec="1244264536"/>
        <to usec="0" sec="1244264582"/>
    </anomaly>
    <anomaly type="suspicious" value="0.743707,0.964958,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="196.210.173.123" src_port="1231" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1244264536"/>
        <to usec="0" sec="1244264582"/>
    </anomaly>
    <anomaly type="suspicious" value="0.743707,0.964958,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="200.17.103.152" src_port="3468" dst_port="31953"/>
        </slice>
        <from usec="0" sec="1244264536"/>
        <to usec="0" sec="1244264807"/>
    </anomaly>
</admd:annotation>
