<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="anomalous" value="1.925840,1.601860,503,1 1 0 1 1 1 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="204.91.5.174" src_port="13761"/>
            <filter src_ip="204.91.5.174" dst_port="80"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246943699"/>
    </anomaly>
    <anomaly type="anomalous" value="1.375370,1.271140,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="40.125.219.8" dst_port="23"/>
        </slice>
        <from usec="0" sec="1246943545"/>
        <to usec="0" sec="1246943633"/>
    </anomaly>
    <anomaly type="anomalous" value="1.345930,1.282380,999,1 1 1 0 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="136.90.13.52" dst_ip="204.81.220.56" src_port="44616" dst_port="110"/>
            <filter src_ip="141.179.130.246" dst_ip="204.81.220.56" src_port="51381" dst_port="110"/>
            <filter src_ip="204.80.42.67" dst_ip="204.81.220.56" src_port="21800" dst_port="110"/>
            <filter src_ip="141.179.228.18" dst_ip="204.81.220.56" src_port="1490" dst_port="110"/>
        </slice>
        <from usec="0" sec="1246943625"/>
        <to usec="0" sec="1246943634"/>
    </anomaly>
    <anomaly type="anomalous" value="1.603360,1.393660,020,1 1 1 0 0 0 1 1 1 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="92.16.22.171"/>
        </slice>
        <from usec="0" sec="1246943296"/>
        <to usec="0" sec="1246943342"/>
    </anomaly>
    <anomaly type="anomalous" value="1.603360,1.393660,503,1 1 1 0 0 0 1 1 1 0 0 0,ntscACK">
        <slice>
            <filter src_ip="136.90.66.98" dst_port="80"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246943699"/>
    </anomaly>
    <anomaly type="anomalous" value="1.345930,1.282380,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="202.238.25.117" src_port="12200" dst_port="1080"/>
            <filter src_ip="202.238.25.117" src_port="12200" dst_port="8080"/>
        </slice>
        <from usec="0" sec="1246943377"/>
        <to usec="0" sec="1246943379"/>
    </anomaly>
    <anomaly type="anomalous" value="1.345930,1.282380,999,1 1 1 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="136.90.77.229" dst_ip="204.70.5.6" src_port="58060" dst_port="25"/>
        </slice>
        <from usec="0" sec="1246943649"/>
        <to usec="0" sec="1246943651"/>
    </anomaly>
    <anomaly type="anomalous" value="1.345930,1.282380,503,1 1 1 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="136.90.146.50" src_port="26917"/>
            <filter src_ip="136.90.146.50" dst_port="80"/>
        </slice>
        <from usec="0" sec="1246942812"/>
        <to usec="0" sec="1246943584"/>
    </anomaly>
    <anomaly type="anomalous" value="1.345930,1.282380,999,1 1 1 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="136.90.90.100" src_port="25"/>
            <filter src_ip="136.90.90.100" dst_ip="218.170.81.242" dst_port="25"/>
        </slice>
        <from usec="0" sec="1246943661"/>
        <to usec="0" sec="1246943683"/>
    </anomaly>
    <anomaly type="anomalous" value="2.264870,1.838730,999,1 1 1 1 1 1 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="205.100.241.55" src_port="53"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246943449"/>
    </anomaly>
    <anomaly type="anomalous" value="1.345930,1.282380,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="202.238.25.19" src_port="12200" dst_port="1080"/>
        </slice>
        <from usec="0" sec="1246943057"/>
        <to usec="0" sec="1246943159"/>
    </anomaly>
    <anomaly type="anomalous" value="1.345930,1.282380,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="202.238.25.77" src_port="12200" dst_port="1080"/>
        </slice>
        <from usec="0" sec="1246943168"/>
        <to usec="0" sec="1246943259"/>
    </anomaly>
    <anomaly type="anomalous" value="1.375370,1.271140,503,1 1 1 0 0 0 1 0 0 0 0 0,heavy_hitter">
        <slice>
            <filter src_ip="23.162.229.138" dst_ip="205.100.248.190" dst_port="80"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246943694"/>
    </anomaly>
    <anomaly type="anomalous" value="2.410130,1.925460,010,1 1 1 1 1 1 1 1 1 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="92.16.22.171" src_port="6000" dst_port="2967"/>
        </slice>
        <from usec="0" sec="1246943296"/>
        <to usec="0" sec="1246943342"/>
    </anomaly>
    <anomaly type="anomalous" value="2.048730,1.655560,999,1 0 0 1 1 1 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="205.100.250.68"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246943701"/>
    </anomaly>
    <anomaly type="anomalous" value="2.264870,1.838730,010,1 1 1 1 1 1 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="93.162.202.0" src_port="6000" dst_port="2967"/>
        </slice>
        <from usec="0" sec="1246942846"/>
        <to usec="0" sec="1246942896"/>
    </anomaly>
    <anomaly type="anomalous" value="1.137010,1.046680,999,1 0 0 1 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter dst_ip="205.100.251.48" dst_port="3124"/>
            <filter dst_ip="205.100.251.48" dst_port="3128"/>
            <filter dst_ip="205.100.251.49" dst_port="3124"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246943618"/>
    </anomaly>
    <anomaly type="anomalous" value="1.597270,1.325020,999,1 0 0 1 1 0 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="205.100.250.69"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246943701"/>
    </anomaly>
    <anomaly type="anomalous" value="1.854210,1.563040,999,1 0 0 1 1 1 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="204.91.5.174" dst_port="13761"/>
            <filter src_ip="71.58.31.73" dst_ip="204.91.5.174" src_port="80"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246943659"/>
    </anomaly>
    <anomaly type="anomalous" value="1.860380,1.574940,503,0 0 0 1 1 1 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="17.121.60.72" dst_ip="141.166.221.32" src_port="80"/>
        </slice>
        <from usec="0" sec="1246942803"/>
        <to usec="0" sec="1246943622"/>
    </anomaly>
    <anomaly type="anomalous" value="2.264870,1.838730,010,1 1 1 1 1 1 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="216.232.25.79" dst_port="22"/>
        </slice>
        <from usec="0" sec="1246943562"/>
        <to usec="0" sec="1246943699"/>
    </anomaly>
    <anomaly type="anomalous" value="1.347210,1.222800,503,0 0 0 1 1 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="205.100.240.132" dst_ip="93.135.40.96" src_port="80"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246943179"/>
    </anomaly>
    <anomaly type="anomalous" value="1.860380,1.574940,999,0 0 0 1 1 1 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="141.179.145.211" dst_ip="25.201.17.147"/>
            <filter src_ip="141.179.145.211" src_port="18914"/>
            <filter dst_ip="25.201.17.147" src_port="18914"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246943089"/>
    </anomaly>
    <anomaly type="anomalous" value="1.860380,1.574940,503,0 0 0 1 1 1 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="136.90.206.214" src_port="53"/>
            <filter src_ip="204.155.75.84" dst_ip="136.90.206.214" src_port="80"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246943179"/>
    </anomaly>
    <anomaly type="anomalous" value="1.854210,1.563040,503,1 0 0 1 1 1 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="71.60.157.0" dst_ip="136.90.72.246" src_port="80"/>
            <filter src_ip="90.72.108.0" dst_ip="136.90.72.246" src_port="80"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246943269"/>
    </anomaly>
    <anomaly type="anomalous" value="1.347210,1.222800,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="141.161.112.41" dst_ip="42.30.222.192" src_port="80"/>
        </slice>
        <from usec="0" sec="1246942821"/>
        <to usec="0" sec="1246943262"/>
    </anomaly>
    <anomaly type="anomalous" value="1.860380,1.574940,503,0 0 0 1 1 1 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="26.2.214.17" dst_ip="141.166.221.33" src_port="80"/>
        </slice>
        <from usec="0" sec="1246942812"/>
        <to usec="0" sec="1246943628"/>
    </anomaly>
    <anomaly type="anomalous" value="1.881790,1.565800,503,0 0 0 1 1 1 1 0 0 0 0 0,heavy_hitter">
        <slice>
            <filter src_ip="205.100.248.190" dst_ip="23.162.229.138" src_port="80"/>
        </slice>
        <from usec="0" sec="1246942853"/>
        <to usec="0" sec="1246943448"/>
    </anomaly>
    <anomaly type="anomalous" value="1.860380,1.574940,503,0 0 0 1 1 1 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="141.179.174.0" src_port="80"/>
            <filter dst_ip="42.30.222.18" src_port="80"/>
        </slice>
        <from usec="0" sec="1246942878"/>
        <to usec="0" sec="1246943494"/>
    </anomaly>
    <anomaly type="anomalous" value="1.860380,1.574940,999,0 0 0 1 1 1 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="169.185.37.162" dst_ip="218.170.84.13" src_port="995" dst_port="54216"/>
        </slice>
        <from usec="0" sec="1246943535"/>
        <to usec="0" sec="1246943580"/>
    </anomaly>
    <anomaly type="anomalous" value="1.860380,1.574940,503,0 0 0 1 1 1 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="141.161.171.122" dst_ip="42.30.220.166" src_port="80" dst_port="43866"/>
            <filter src_ip="137.58.10.170" dst_ip="42.30.220.166" src_port="53" dst_port="57772"/>
        </slice>
        <from usec="0" sec="1246942809"/>
        <to usec="0" sec="1246942858"/>
    </anomaly>
    <anomaly type="anomalous" value="1.147050,1.064370,503,0 0 0 1 0 0 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="204.80.42.67" src_port="53"/>
            <filter dst_ip="204.80.42.67" src_port="80"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246943089"/>
    </anomaly>
    <anomaly type="anomalous" value="1.147050,1.064370,999,0 0 0 1 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="204.80.30.2" dst_port="6881"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246943481"/>
    </anomaly>
    <anomaly type="anomalous" value="1.603360,1.393660,503,1 1 1 0 0 0 1 1 1 0 0 0,ntscACK">
        <slice>
            <filter src_ip="204.80.30.250" dst_port="80"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246943699"/>
    </anomaly>
    <anomaly type="anomalous" value="1.250430,1.103810,503,1 1 0 1 0 0 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="205.100.253.30" dst_port="80"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246943698"/>
    </anomaly>
    <anomaly type="anomalous" value="1.468410,1.313050,503,1 1 1 0 0 0 1 1 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="204.91.5.141" dst_port="80"/>
            <filter dst_ip="90.23.6.160" dst_port="80"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246943699"/>
    </anomaly>
    <anomaly type="anomalous" value="1.147050,1.064370,999,0 0 0 1 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter src_ip="30.193.208.133" dst_ip="204.91.174.236"/>
            <filter dst_ip="204.91.174.236" dst_port="15000"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246943437"/>
    </anomaly>
    <anomaly type="anomalous" value="2.410130,1.925460,999,1 1 1 1 1 1 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="205.100.250.68"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246943701"/>
    </anomaly>
    <anomaly type="anomalous" value="1.071930,1.000100,503,1 1 0 1 0 0 1 1 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="169.185.0.24" src_port="80"/>
            <filter dst_ip="169.185.0.24" dst_port="80"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246943698"/>
    </anomaly>
    <anomaly type="anomalous" value="2.040270,1.649910,999,1 1 1 1 1 0 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="205.100.250.69"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246943701"/>
    </anomaly>
    <anomaly type="anomalous" value="1.273130,1.221850,010,1 0 1 0 0 0 1 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="202.238.25.112" src_port="12200" dst_port="8080"/>
            <filter src_ip="202.238.25.112" src_port="12200" dst_port="1080"/>
        </slice>
        <from usec="0" sec="1246943238"/>
        <to usec="0" sec="1246943522"/>
    </anomaly>
    <anomaly type="anomalous" value="1.109100,1.048150,503,1 1 0 0 0 0 1 1 1 0 0 0,ntscACK">
        <slice>
            <filter src_ip="204.80.42.67" dst_port="80"/>
        </slice>
        <from usec="0" sec="1246942891"/>
        <to usec="0" sec="1246943699"/>
    </anomaly>
    <anomaly type="anomalous" value="1.704170,1.435990,999,1 1 1 1 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="193.137.56.227" dst_port="53"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246943698"/>
    </anomaly>
    <anomaly type="anomalous" value="1.147050,1.064370,999,0 0 0 1 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="205.100.245.132" dst_port="39733"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246943610"/>
    </anomaly>
    <anomaly type="anomalous" value="1.347210,1.222800,503,0 0 0 1 1 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="204.91.2.205" dst_port="80"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246942909"/>
    </anomaly>
    <anomaly type="suspicious" value="0.903093,0.938302,999,1 1 0 0 0 0 1 1 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="205.100.251.49"/>
        </slice>
        <from usec="0" sec="1246942891"/>
        <to usec="0" sec="1246943695"/>
    </anomaly>
    <anomaly type="suspicious" value="0.686211,0.894890,503,1 1 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="169.185.135.29" dst_port="80"/>
        </slice>
        <from usec="0" sec="1246942809"/>
        <to usec="0" sec="1246943663"/>
    </anomaly>
    <anomaly type="suspicious" value="0.686211,0.894890,999,1 1 0 0 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="104.130.10.226" dst_port="993"/>
            <filter dst_ip="104.130.10.226" dst_port="143"/>
        </slice>
        <from usec="0" sec="1246943167"/>
        <to usec="0" sec="1246943695"/>
    </anomaly>
    <anomaly type="suspicious" value="0.896852,0.959489,503,1 1 0 1 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="136.90.242.109" dst_port="80"/>
        </slice>
        <from usec="0" sec="1246942877"/>
        <to usec="0" sec="1246943599"/>
    </anomaly>
    <anomaly type="suspicious" value="0.686211,0.894890,503,1 1 0 0 0 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="136.90.217.254" dst_port="80"/>
            <filter src_ip="136.90.70.115" dst_ip="204.81.6.206"/>
            <filter src_ip="136.90.70.115" dst_port="80"/>
            <filter dst_ip="204.81.6.206" dst_port="80"/>
        </slice>
        <from usec="0" sec="1246943561"/>
        <to usec="0" sec="1246943699"/>
    </anomaly>
    <anomaly type="suspicious" value="0.742287,0.878702,503,1 1 0 0 0 0 1 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="136.90.107.219" dst_port="80"/>
            <filter src_ip="204.80.42.67" dst_port="80"/>
            <filter dst_ip="104.205.180.110" dst_port="80"/>
        </slice>
        <from usec="0" sec="1246943296"/>
        <to usec="0" sec="1246943699"/>
    </anomaly>
    <anomaly type="suspicious" value="0.686211,0.894890,503,1 1 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="136.90.107.216" dst_port="80"/>
            <filter src_ip="136.90.167.39" dst_port="80"/>
        </slice>
        <from usec="0" sec="1246943266"/>
        <to usec="0" sec="1246943698"/>
    </anomaly>
    <anomaly type="suspicious" value="0.686211,0.894890,503,1 1 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="169.185.201.202" dst_ip="200.1.123.215" dst_port="80"/>
            <filter src_ip="169.185.201.202" dst_ip="200.1.122.19" dst_port="80"/>
        </slice>
        <from usec="0" sec="1246943555"/>
        <to usec="0" sec="1246943698"/>
    </anomaly>
    <anomaly type="suspicious" value="0.686211,0.894890,503,1 1 0 0 0 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="93.40.88.153" dst_ip="169.185.74.20" dst_port="80"/>
            <filter src_ip="17.199.96.123" dst_ip="169.185.74.20" dst_port="80"/>
        </slice>
        <from usec="0" sec="1246943596"/>
        <to usec="0" sec="1246943699"/>
    </anomaly>
    <anomaly type="suspicious" value="0.686211,0.894890,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="136.90.142.196" dst_ip="47.164.147.161" src_port="1062" dst_port="80"/>
        </slice>
        <from usec="0" sec="1246943168"/>
        <to usec="0" sec="1246943699"/>
    </anomaly>
    <anomaly type="suspicious" value="0.686211,0.894890,999,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="136.90.144.144" dst_ip="204.81.222.76" src_port="54832" dst_port="25"/>
        </slice>
        <from usec="0" sec="1246943588"/>
        <to usec="0" sec="1246943590"/>
    </anomaly>
    <anomaly type="suspicious" value="0.686211,0.894890,503,1 1 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="205.100.251.56" src_port="80"/>
        </slice>
        <from usec="0" sec="1246943324"/>
        <to usec="0" sec="1246943643"/>
    </anomaly>
    <anomaly type="suspicious" value="0.686211,0.894890,503,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="136.90.240.33" dst_ip="216.166.64.197" src_port="1177" dst_port="80"/>
        </slice>
        <from usec="0" sec="1246943605"/>
        <to usec="0" sec="1246943607"/>
    </anomaly>
    <anomaly type="suspicious" value="0.686211,0.894890,999,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="38.58.55.250" dst_ip="205.100.225.133" src_port="49162" dst_port="1062"/>
        </slice>
        <from usec="0" sec="1246943167"/>
        <to usec="0" sec="1246943699"/>
    </anomaly>
    <anomaly type="suspicious" value="0.686211,0.894890,503,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="136.90.167.38" dst_ip="60.79.70.138" dst_port="80"/>
        </slice>
        <from usec="0" sec="1246943257"/>
        <to usec="0" sec="1246943698"/>
    </anomaly>
    <anomaly type="suspicious" value="0.686211,0.894890,503,1 1 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="169.185.74.82" src_port="80"/>
        </slice>
        <from usec="0" sec="1246943597"/>
        <to usec="0" sec="1246943699"/>
    </anomaly>
    <anomaly type="suspicious" value="0.702730,0.915518,503,0 1 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="169.185.156.146" dst_ip="26.149.33.69" dst_port="80"/>
            <filter src_ip="169.185.156.146" dst_ip="26.149.34.25" dst_port="80"/>
        </slice>
        <from usec="0" sec="1246943607"/>
        <to usec="0" sec="1246943667"/>
    </anomaly>
    <anomaly type="suspicious" value="0.686211,0.894890,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="136.90.66.101" dst_ip="42.226.36.65" src_port="51929" dst_port="80"/>
            <filter src_ip="136.90.66.101" dst_ip="42.226.36.65" src_port="51884" dst_port="80"/>
            <filter src_ip="136.90.66.101" dst_ip="42.226.36.65" src_port="51783" dst_port="80"/>
        </slice>
        <from usec="0" sec="1246943341"/>
        <to usec="0" sec="1246943699"/>
    </anomaly>
    <anomaly type="suspicious" value="0.686211,0.894890,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="136.90.105.94" dst_ip="91.52.161.70" src_port="2214" dst_port="80"/>
            <filter src_ip="136.90.105.94" dst_ip="91.52.161.70" src_port="2212" dst_port="80"/>
            <filter src_ip="136.90.105.94" dst_ip="91.52.161.70" src_port="2189" dst_port="80"/>
            <filter src_ip="136.90.105.94" dst_ip="91.52.161.70" src_port="2187" dst_port="80"/>
        </slice>
        <from usec="0" sec="1246943592"/>
        <to usec="0" sec="1246943639"/>
    </anomaly>
    <anomaly type="suspicious" value="0.686211,0.894890,503,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="136.90.67.230" dst_ip="196.235.5.15" src_port="1832" dst_port="80"/>
        </slice>
        <from usec="0" sec="1246943628"/>
        <to usec="0" sec="1246943631"/>
    </anomaly>
    <anomaly type="suspicious" value="0.686211,0.894890,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="136.90.240.1" dst_ip="33.66.116.226" src_port="4015" dst_port="80"/>
        </slice>
        <from usec="0" sec="1246943564"/>
        <to usec="0" sec="1246943615"/>
    </anomaly>
    <anomaly type="suspicious" value="0.686211,0.894890,503,1 1 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="136.90.167.72" dst_port="53"/>
            <filter src_ip="136.90.167.72" dst_port="80"/>
        </slice>
        <from usec="0" sec="1246943565"/>
        <to usec="0" sec="1246943671"/>
    </anomaly>
    <anomaly type="suspicious" value="0.686211,0.894890,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="169.185.47.34" dst_ip="60.72.101.8" src_port="51843" dst_port="80"/>
        </slice>
        <from usec="0" sec="1246942812"/>
        <to usec="0" sec="1246943699"/>
    </anomaly>
    <anomaly type="suspicious" value="0.686211,0.894890,999,1 1 0 0 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="155.56.50.173" dst_ip="172.133.32.168" src_port="63650" dst_port="53"/>
            <filter src_ip="34.235.108.62" dst_ip="172.133.32.168" src_port="56968" dst_port="53"/>
            <filter src_ip="51.148.162.210" dst_ip="172.133.32.168" src_port="37652" dst_port="53"/>
            <filter src_ip="60.246.87.19" dst_ip="172.133.32.168" src_port="6969" dst_port="53"/>
            <filter src_ip="182.94.126.205" dst_ip="172.133.32.168" src_port="47982" dst_port="53"/>
        </slice>
        <from usec="0" sec="1246942875"/>
        <to usec="0" sec="1246943699"/>
    </anomaly>
    <anomaly type="suspicious" value="0.686211,0.894890,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="136.90.112.9" dst_ip="9.98.151.203" src_port="3542" dst_port="80"/>
            <filter src_ip="136.90.112.9" dst_ip="9.98.151.203" src_port="3541" dst_port="80"/>
        </slice>
        <from usec="0" sec="1246943637"/>
        <to usec="0" sec="1246943650"/>
    </anomaly>
    <anomaly type="suspicious" value="0.742287,0.878702,503,1 1 0 0 0 0 1 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="169.185.0.24" dst_port="80"/>
        </slice>
        <from usec="0" sec="1246943257"/>
        <to usec="0" sec="1246943699"/>
    </anomaly>
    <anomaly type="suspicious" value="0.686211,0.894890,504,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="141.179.199.20" dst_ip="160.244.64.234" src_port="53041" dst_port="443"/>
        </slice>
        <from usec="0" sec="1246943359"/>
        <to usec="0" sec="1246943362"/>
    </anomaly>
    <anomaly type="suspicious" value="0.686211,0.894890,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="169.185.202.97" dst_ip="32.236.147.12" src_port="1947" dst_port="80"/>
        </slice>
        <from usec="0" sec="1246943560"/>
        <to usec="0" sec="1246943698"/>
    </anomaly>
    <anomaly type="suspicious" value="0.686211,0.894890,999,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="141.179.243.179" dst_ip="218.170.84.161" src_port="22478" dst_port="25"/>
        </slice>
        <from usec="0" sec="1246943552"/>
        <to usec="0" sec="1246943580"/>
    </anomaly>
    <anomaly type="suspicious" value="0.686211,0.894890,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="136.90.214.114" dst_ip="194.13.250.133" src_port="1702" dst_port="80"/>
        </slice>
        <from usec="0" sec="1246943560"/>
        <to usec="0" sec="1246943639"/>
    </anomaly>
    <anomaly type="suspicious" value="0.686211,0.894890,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="136.90.21.179" dst_ip="53.218.184.251" src_port="2482" dst_port="80"/>
        </slice>
        <from usec="0" sec="1246943323"/>
        <to usec="0" sec="1246943698"/>
    </anomaly>
    <anomaly type="suspicious" value="0.702730,0.915518,010,0 1 0 0 0 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="202.238.25.112" src_port="12200" dst_port="8080"/>
            <filter src_ip="202.238.25.112" src_port="12200" dst_port="1080"/>
        </slice>
        <from usec="0" sec="1246943238"/>
        <to usec="0" sec="1246943491"/>
    </anomaly>
    <anomaly type="suspicious" value="0.686211,0.894890,901,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="136.90.74.16" dst_ip="196.235.67.113" dst_port="80"/>
        </slice>
        <from usec="0" sec="1246943581"/>
        <to usec="0" sec="1246943651"/>
    </anomaly>
    <anomaly type="suspicious" value="0.686211,0.894890,503,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="136.90.67.122" dst_ip="91.53.145.217" src_port="3216" dst_port="80"/>
        </slice>
        <from usec="0" sec="1246943632"/>
        <to usec="0" sec="1246943634"/>
    </anomaly>
    <anomaly type="suspicious" value="0.686211,0.894890,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="141.179.130.137" dst_ip="53.218.185.55" src_port="51691" dst_port="80"/>
        </slice>
        <from usec="0" sec="1246943341"/>
        <to usec="0" sec="1246943671"/>
    </anomaly>
    <anomaly type="suspicious" value="0.686211,0.894890,503,1 1 0 0 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="169.185.74.94" dst_port="80"/>
        </slice>
        <from usec="0" sec="1246943167"/>
        <to usec="0" sec="1246943655"/>
    </anomaly>
    <anomaly type="suspicious" value="0.686211,0.894890,503,1 1 0 0 0 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="217.198.21.16" dst_ip="205.100.248.216" src_port="32947" dst_port="80"/>
            <filter src_ip="217.198.21.16" dst_ip="205.100.248.216" src_port="32946" dst_port="80"/>
            <filter src_ip="217.198.21.74" dst_ip="205.100.248.216" src_port="2525" dst_port="80"/>
        </slice>
        <from usec="0" sec="1246943644"/>
        <to usec="0" sec="1246943646"/>
    </anomaly>
    <anomaly type="suspicious" value="0.742287,0.878702,503,1 1 0 0 0 0 1 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="204.80.31.60" dst_port="80"/>
        </slice>
        <from usec="0" sec="1246942815"/>
        <to usec="0" sec="1246943699"/>
    </anomaly>
    <anomaly type="suspicious" value="0.686211,0.894890,999,1 1 0 0 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="218.170.72.18" dst_port="993"/>
        </slice>
        <from usec="0" sec="1246943167"/>
        <to usec="0" sec="1246943169"/>
    </anomaly>
    <anomaly type="suspicious" value="0.686211,0.894890,503,1 1 0 0 0 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="136.90.112.51" dst_ip="196.235.1.176" dst_port="80"/>
            <filter src_ip="136.90.76.212" dst_ip="196.235.1.176" dst_port="80"/>
            <filter src_ip="136.90.71.47" dst_ip="196.235.1.176" dst_port="80"/>
        </slice>
        <from usec="0" sec="1246943585"/>
        <to usec="0" sec="1246943590"/>
    </anomaly>
    <anomaly type="suspicious" value="0.686211,0.894890,503,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="205.100.251.57" dst_ip="0.20.67.249" src_port="60950" dst_port="80"/>
            <filter src_ip="205.100.251.57" dst_ip="0.20.67.249" src_port="60765" dst_port="80"/>
            <filter src_ip="205.100.251.57" dst_ip="0.20.67.249" src_port="60764" dst_port="80"/>
        </slice>
        <from usec="0" sec="1246943652"/>
        <to usec="0" sec="1246943666"/>
    </anomaly>
    <anomaly type="suspicious" value="0.686211,0.894890,504,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="22.50.176.101" dst_ip="204.91.6.106" dst_port="443"/>
        </slice>
        <from usec="0" sec="1246943597"/>
        <to usec="0" sec="1246943624"/>
    </anomaly>
    <anomaly type="suspicious" value="0.686211,0.894890,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="43.210.204.28" dst_ip="169.185.146.1" dst_port="80"/>
        </slice>
        <from usec="0" sec="1246943568"/>
        <to usec="0" sec="1246943590"/>
    </anomaly>
    <anomaly type="suspicious" value="0.686211,0.894890,503,1 1 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="169.185.202.34" dst_ip="219.38.167.84" dst_port="80"/>
            <filter src_ip="169.185.202.34" dst_ip="42.92.165.181" dst_port="80"/>
        </slice>
        <from usec="0" sec="1246943564"/>
        <to usec="0" sec="1246943567"/>
    </anomaly>
    <anomaly type="suspicious" value="0.686211,0.894890,503,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="32.131.32.95" dst_ip="169.185.145.31" dst_port="80"/>
        </slice>
        <from usec="0" sec="1246943596"/>
        <to usec="0" sec="1246943699"/>
    </anomaly>
    <anomaly type="suspicious" value="0.686211,0.894890,503,1 1 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="16.22.128.127" dst_ip="169.185.74.82" src_port="20596" dst_port="80"/>
            <filter src_ip="16.22.128.127" dst_ip="169.185.74.82" src_port="20592" dst_port="80"/>
            <filter src_ip="16.22.128.127" dst_ip="169.185.74.80" src_port="20600" dst_port="80"/>
        </slice>
        <from usec="0" sec="1246943588"/>
        <to usec="0" sec="1246943590"/>
    </anomaly>
    <anomaly type="suspicious" value="0.686211,0.894890,503,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="136.90.74.93" dst_ip="204.81.92.252" dst_port="80"/>
        </slice>
        <from usec="0" sec="1246943601"/>
        <to usec="0" sec="1246943603"/>
    </anomaly>
    <anomaly type="suspicious" value="0.686211,0.894890,503,1 1 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="136.90.117.250" dst_ip="204.81.58.173" dst_port="80"/>
            <filter src_ip="136.90.117.250" dst_ip="204.81.58.183" dst_port="80"/>
            <filter src_ip="136.90.117.250" dst_ip="22.50.186.119" dst_port="80"/>
        </slice>
        <from usec="0" sec="1246943645"/>
        <to usec="0" sec="1246943647"/>
    </anomaly>
    <anomaly type="suspicious" value="0.686211,0.894890,503,1 1 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="169.185.202.108" dst_ip="37.7.171.41" dst_port="80"/>
            <filter src_ip="169.185.202.108" dst_ip="37.7.171.42" dst_port="80"/>
        </slice>
        <from usec="0" sec="1246943584"/>
        <to usec="0" sec="1246943586"/>
    </anomaly>
    <anomaly type="suspicious" value="0.742287,0.878702,504,1 1 0 0 0 0 1 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="141.179.106.108" dst_ip="91.53.44.84" dst_port="443"/>
        </slice>
        <from usec="0" sec="1246943566"/>
        <to usec="0" sec="1246943671"/>
    </anomaly>
    <anomaly type="suspicious" value="0.686211,0.894890,503,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="16.195.136.11" dst_ip="169.185.74.24" dst_port="80"/>
        </slice>
        <from usec="0" sec="1246943644"/>
        <to usec="0" sec="1246943655"/>
    </anomaly>
    <anomaly type="suspicious" value="0.686211,0.894890,503,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="27.83.33.108" dst_ip="169.185.74.26" dst_port="80"/>
        </slice>
        <from usec="0" sec="1246943661"/>
        <to usec="0" sec="1246943667"/>
    </anomaly>
    <anomaly type="suspicious" value="0.686211,0.894890,504,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="136.90.25.131" dst_ip="89.38.196.158" dst_port="443"/>
        </slice>
        <from usec="0" sec="1246943585"/>
        <to usec="0" sec="1246943590"/>
    </anomaly>
    <anomaly type="suspicious" value="0.686211,0.894890,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="202.238.25.74" src_port="12200" dst_port="1080"/>
        </slice>
        <from usec="0" sec="1246943267"/>
        <to usec="0" sec="1246943268"/>
    </anomaly>
    <anomaly type="suspicious" value="0.702730,0.915518,010,0 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="55.42.111.76" dst_port="445" proto="tcp"/>
        </slice>
        <from usec="0" sec="1246943508"/>
        <to usec="0" sec="1246943542"/>
    </anomaly>
    <anomaly type="suspicious" value="0.903093,0.938302,010,1 1 0 0 0 0 1 1 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="180.152.76.90" dst_port="445"/>
            <filter src_ip="180.152.76.90" dst_port="139"/>
        </slice>
        <from usec="0" sec="1246943296"/>
        <to usec="0" sec="1246943365"/>
    </anomaly>
    <anomaly type="suspicious" value="0.686211,0.894890,503,1 1 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="204.91.2.205" dst_port="80"/>
        </slice>
        <from usec="0" sec="1246942812"/>
        <to usec="0" sec="1246943698"/>
    </anomaly>
    <anomaly type="suspicious" value="0.745994,0.913836,999,0 0 0 1 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="141.179.130.27"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246942999"/>
    </anomaly>
    <anomaly type="suspicious" value="0.745994,0.913836,504,0 0 0 1 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="40.103.41.24"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246942909"/>
    </anomaly>
    <anomaly type="suspicious" value="0.745994,0.913836,503,0 0 0 1 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="219.18.125.217"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246942987"/>
    </anomaly>
    <anomaly type="suspicious" value="0.745994,0.913836,999,0 0 0 1 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="136.90.144.144" dst_port="25"/>
            <filter src_ip="136.90.144.144" src_port="63393" dst_port="53"/>
        </slice>
        <from usec="0" sec="1246942806"/>
        <to usec="0" sec="1246942999"/>
    </anomaly>
    <anomaly type="suspicious" value="0.745994,0.913836,503,0 0 0 1 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="141.90.42.57"/>
        </slice>
        <from usec="0" sec="1246942817"/>
        <to usec="0" sec="1246942957"/>
    </anomaly>
    <anomaly type="suspicious" value="0.745994,0.913836,503,0 0 0 1 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="136.90.150.80"/>
        </slice>
        <from usec="0" sec="1246942830"/>
        <to usec="0" sec="1246943088"/>
    </anomaly>
    <anomaly type="suspicious" value="0.745994,0.913836,999,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="216.46.217.149"/>
        </slice>
        <from usec="0" sec="1246942916"/>
        <to usec="0" sec="1246942930"/>
    </anomaly>
    <anomaly type="suspicious" value="0.745994,0.913836,503,0 0 0 1 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="204.197.64.2"/>
        </slice>
        <from usec="0" sec="1246942927"/>
        <to usec="0" sec="1246943022"/>
    </anomaly>
    <anomaly type="suspicious" value="0.745994,0.913836,503,0 0 0 1 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="141.179.243.36"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246943179"/>
    </anomaly>
    <anomaly type="suspicious" value="0.745994,0.913836,503,0 0 0 1 0 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="205.100.244.1"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246943178"/>
    </anomaly>
    <anomaly type="suspicious" value="0.745994,0.913836,503,0 0 0 1 0 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="136.90.249.21"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246943179"/>
    </anomaly>
    <anomaly type="suspicious" value="0.745994,0.913836,501,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="205.100.244.97"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246943179"/>
    </anomaly>
    <anomaly type="suspicious" value="0.745994,0.913836,999,0 0 0 1 0 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="205.100.248.199"/>
        </slice>
        <from usec="0" sec="1246942802"/>
        <to usec="0" sec="1246943179"/>
    </anomaly>
    <anomaly type="suspicious" value="0.745994,0.913836,999,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="136.90.89.57"/>
        </slice>
        <from usec="0" sec="1246942808"/>
        <to usec="0" sec="1246943172"/>
    </anomaly>
    <anomaly type="suspicious" value="0.745994,0.913836,503,0 0 0 1 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="201.141.49.160"/>
        </slice>
        <from usec="0" sec="1246942874"/>
        <to usec="0" sec="1246943205"/>
    </anomaly>
    <anomaly type="suspicious" value="0.745994,0.913836,503,0 0 0 1 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="25.27.173.25"/>
        </slice>
        <from usec="0" sec="1246943077"/>
        <to usec="0" sec="1246943103"/>
    </anomaly>
    <anomaly type="suspicious" value="0.745994,0.913836,999,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="16.34.16.34"/>
        </slice>
        <from usec="0" sec="1246943100"/>
        <to usec="0" sec="1246943119"/>
    </anomaly>
    <anomaly type="suspicious" value="0.745994,0.913836,020,0 0 0 1 0 0 0 0 0 0 0 0,ttl_error">
        <slice>
            <filter src_ip="57.99.70.148"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246943266"/>
    </anomaly>
    <anomaly type="suspicious" value="0.745994,0.913836,999,0 0 0 1 0 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="141.179.8.122"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246943264"/>
    </anomaly>
    <anomaly type="suspicious" value="0.745994,0.913836,999,0 0 0 1 0 0 0 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="141.5.224.175" src_port="53"/>
        </slice>
        <from usec="0" sec="1246942802"/>
        <to usec="0" sec="1246943269"/>
    </anomaly>
    <anomaly type="suspicious" value="0.745994,0.913836,020,0 0 0 1 0 0 0 0 0 0 0 0,hostout">
        <slice>
            <filter src_ip="205.100.225.212"/>
        </slice>
        <from usec="0" sec="1246942803"/>
        <to usec="0" sec="1246943359"/>
    </anomaly>
    <anomaly type="suspicious" value="0.745994,0.913836,503,0 0 0 1 0 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="136.90.76.200"/>
        </slice>
        <from usec="0" sec="1246943023"/>
        <to usec="0" sec="1246943237"/>
    </anomaly>
    <anomaly type="suspicious" value="0.745994,0.913836,999,0 0 0 1 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="59.164.85.232"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246943359"/>
    </anomaly>
    <anomaly type="suspicious" value="0.745994,0.913836,503,0 0 0 1 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="204.80.28.181"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246943355"/>
    </anomaly>
    <anomaly type="suspicious" value="0.745994,0.913836,503,0 0 0 1 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="141.161.242.159"/>
        </slice>
        <from usec="0" sec="1246942813"/>
        <to usec="0" sec="1246943357"/>
    </anomaly>
    <anomaly type="suspicious" value="0.745994,0.913836,503,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="203.70.176.27"/>
        </slice>
        <from usec="0" sec="1246943150"/>
        <to usec="0" sec="1246943295"/>
    </anomaly>
    <anomaly type="suspicious" value="0.745994,0.913836,999,0 0 0 1 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="170.81.146.180" src_port="53"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246943539"/>
    </anomaly>
    <anomaly type="suspicious" value="0.745994,0.913836,503,0 0 0 1 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="205.100.246.108"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246943534"/>
    </anomaly>
    <anomaly type="suspicious" value="0.745994,0.913836,999,0 0 0 1 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="141.161.180.123"/>
        </slice>
        <from usec="0" sec="1246942815"/>
        <to usec="0" sec="1246943520"/>
    </anomaly>
    <anomaly type="suspicious" value="0.745994,0.913836,901,0 0 0 1 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246943629"/>
    </anomaly>
    <anomaly type="suspicious" value="0.745994,0.913836,999,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter dst_ip="23.62.11.93"/>
        </slice>
        <from usec="0" sec="1246942802"/>
        <to usec="0" sec="1246943606"/>
    </anomaly>
    <anomaly type="suspicious" value="0.745994,0.913836,503,0 0 0 1 0 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="38.178.122.107"/>
        </slice>
        <from usec="0" sec="1246942845"/>
        <to usec="0" sec="1246943623"/>
    </anomaly>
    <anomaly type="suspicious" value="0.745994,0.913836,010,0 0 0 1 0 0 0 0 0 0 0 0,sptpDoSSYN">
        <slice>
            <filter src_ip="23.93.210.190" dst_ip="204.91.174.236" dst_port="80"/>
        </slice>
        <from usec="0" sec="1246942933"/>
        <to usec="0" sec="1246943618"/>
    </anomaly>
    <anomaly type="suspicious" value="0.991097,1.006520,999,0 0 0 0 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_ip="205.100.253.131" dst_port="53"/>
            <filter dst_ip="193.1.88.84" dst_port="53"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246943342"/>
    </anomaly>
    <anomaly type="suspicious" value="0.979454,0.987796,503,1 0 0 0 0 0 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="205.100.253.31" dst_port="80"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246943698"/>
    </anomaly>
    <anomaly type="suspicious" value="0.991097,1.006520,999,0 0 0 0 0 0 1 1 1 0 0 0,alphfl">
        <slice>
            <filter src_ip="27.9.179.183" dst_ip="141.42.246.74" dst_port="62997"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246943342"/>
    </anomaly>
    <anomaly type="suspicious" value="0.783369,0.876950,503,1 0 0 1 0 0 1 0 0 0 0 0,mptmp">
        <slice>
            <filter dst_ip="204.80.30.250" src_port="80"/>
            <filter dst_ip="136.90.66.98" src_port="80"/>
        </slice>
        <from usec="0" sec="1246942807"/>
        <to usec="0" sec="1246943378"/>
    </anomaly>
    <anomaly type="suspicious" value="0.991097,1.006520,999,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="141.179.200.6" dst_port="65013"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246942937"/>
    </anomaly>
    <anomaly type="suspicious" value="0.991097,1.006520,020,0 0 0 0 0 0 1 1 1 0 0 0,DDoSIC">
        <slice>
            <filter dst_ip="205.100.241.69"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246942937"/>
    </anomaly>
    <anomaly type="suspicious" value="0.991097,1.006520,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="204.91.175.33" dst_port="25136"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246943387"/>
    </anomaly>
    <anomaly type="suspicious" value="0.991097,1.006520,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="141.179.243.122" src_port="53"/>
            <filter dst_ip="141.179.243.122" dst_port="53"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246942937"/>
    </anomaly>
    <anomaly type="suspicious" value="0.753485,0.891565,999,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="204.91.174.108" dst_port="15000"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246942937"/>
    </anomaly>
    <anomaly type="suspicious" value="0.991097,1.006520,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="205.100.241.48" dst_port="53"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246942937"/>
    </anomaly>
    <anomaly type="suspicious" value="0.991097,1.006520,503,0 0 0 0 0 0 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="172.133.113.250" src_port="80"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246942937"/>
    </anomaly>
    <anomaly type="suspicious" value="0.991097,1.006520,503,0 0 0 0 0 0 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="169.185.0.24" dst_port="80"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246942937"/>
    </anomaly>
    <anomaly type="suspicious" value="0.797879,0.897990,020,0 0 0 1 0 0 1 0 0 0 0 0,ttl_error">
        <slice>
            <filter src_ip="141.42.50.40"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246943342"/>
    </anomaly>
    <anomaly type="suspicious" value="0.753485,0.891565,999,0 0 0 0 0 0 1 1 0 0 0 0,heavy_hitter">
        <slice>
            <filter src_ip="90.185.33.212" dst_ip="205.100.251.49" dst_port="3128"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246943342"/>
    </anomaly>
    <anomaly type="suspicious" value="0.738103,0.870370,010,1 0 0 0 0 0 1 1 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="206.7.33.166" dst_port="445"/>
        </slice>
        <from usec="0" sec="1246943296"/>
        <to usec="0" sec="1246943428"/>
    </anomaly>
    <anomaly type="suspicious" value="0.991097,1.006520,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="204.80.30.2" src_port="6881"/>
        </slice>
        <from usec="0" sec="1246942891"/>
        <to usec="0" sec="1246943612"/>
    </anomaly>
    <anomaly type="suspicious" value="0.949315,0.956389,503,0 0 0 1 0 0 1 1 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="213.9.185.10" dst_ip="205.100.251.48" dst_port="80"/>
            <filter src_ip="92.74.57.46" dst_ip="205.100.251.48" dst_port="80"/>
        </slice>
        <from usec="0" sec="1246942802"/>
        <to usec="0" sec="1246943629"/>
    </anomaly>
    <anomaly type="suspicious" value="0.991097,1.006520,020,0 0 0 0 0 0 1 1 1 0 0 0,DDoSIC">
        <slice>
            <filter dst_ip="205.151.43.46"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246942847"/>
    </anomaly>
    <anomaly type="suspicious" value="0.991097,1.006520,999,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="141.179.199.68" dst_port="49763"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246942937"/>
    </anomaly>
    <anomaly type="suspicious" value="0.991097,1.006520,503,0 0 0 0 0 0 1 1 1 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="204.100.230.16" dst_ip="204.91.2.85" src_port="80"/>
            <filter src_ip="204.100.225.163" dst_ip="204.91.2.85" src_port="443"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246942847"/>
    </anomaly>
    <anomaly type="suspicious" value="0.991097,1.006520,999,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="169.185.74.27" dst_port="3127"/>
            <filter src_ip="91.84.233.199" dst_ip="169.185.74.27" dst_port="3128"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246943342"/>
    </anomaly>
    <anomaly type="suspicious" value="0.991097,1.006520,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="204.91.186.73" dst_port="20481"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246943342"/>
    </anomaly>
    <anomaly type="suspicious" value="0.753485,0.891565,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="204.91.175.10" dst_port="26202"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246942847"/>
    </anomaly>
    <anomaly type="suspicious" value="0.753485,0.891565,020,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="88.89.10.45" src_port="4899"/>
            <filter dst_ip="88.89.10.45"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246942937"/>
    </anomaly>
    <anomaly type="suspicious" value="0.753485,0.891565,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="172.133.113.231" dst_port="53"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246942847"/>
    </anomaly>
    <anomaly type="suspicious" value="0.991097,1.006520,999,0 0 0 0 0 0 1 1 1 0 0 0,mptpla">
        <slice>
            <filter dst_ip="213.88.101.122"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246942847"/>
    </anomaly>
    <anomaly type="suspicious" value="0.979454,0.987796,010,1 0 0 0 0 0 1 1 1 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="60.21.97.181" dst_port="139"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246942847"/>
    </anomaly>
    <anomaly type="suspicious" value="0.991097,1.006520,999,0 0 0 0 0 0 1 1 1 0 0 0,salphfl">
        <slice>
            <filter src_ip="141.179.229.84" dst_ip="210.19.80.118" dst_port="53"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246942847"/>
    </anomaly>
    <anomaly type="suspicious" value="0.991097,1.006520,503,0 0 0 0 0 0 1 1 1 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="136.90.66.101" dst_ip="141.21.12.77" dst_port="80"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246942847"/>
    </anomaly>
    <anomaly type="suspicious" value="0.991097,1.006520,503,0 0 0 0 0 0 1 1 1 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="169.185.250.226" dst_ip="35.88.147.236" dst_port="80"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246942847"/>
    </anomaly>
    <anomaly type="suspicious" value="0.991097,1.006520,999,0 0 0 0 0 0 1 1 1 0 0 0,mptpla">
        <slice>
            <filter src_ip="169.185.97.183" dst_ip="94.4.84.186" dst_port="53"/>
            <filter src_ip="169.185.96.122" dst_ip="94.4.84.186" dst_port="53"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246942847"/>
    </anomaly>
    <anomaly type="suspicious" value="0.991097,1.006520,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="193.137.56.227" src_port="53"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246943612"/>
    </anomaly>
    <anomaly type="suspicious" value="0.991097,1.006520,020,0 0 0 0 0 0 1 1 1 0 0 0,ttl_error">
        <slice>
            <filter src_ip="205.100.245.83"/>
        </slice>
        <from usec="0" sec="1246943296"/>
        <to usec="0" sec="1246943612"/>
    </anomaly>
    <anomaly type="suspicious" value="0.903093,0.938302,999,1 1 0 0 0 0 1 1 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="205.100.251.48"/>
        </slice>
        <from usec="0" sec="1246943257"/>
        <to usec="0" sec="1246943671"/>
    </anomaly>
    <anomaly type="suspicious" value="0.753485,0.891565,999,0 0 0 0 0 0 1 1 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="141.179.199.68" src_port="49763"/>
        </slice>
        <from usec="0" sec="1246943296"/>
        <to usec="0" sec="1246943342"/>
    </anomaly>
    <anomaly type="suspicious" value="0.753485,0.891565,999,0 0 0 0 0 0 1 1 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="141.179.200.6" src_port="65013"/>
        </slice>
        <from usec="0" sec="1246943296"/>
        <to usec="0" sec="1246943342"/>
    </anomaly>
    <anomaly type="suspicious" value="0.753485,0.891565,999,0 0 0 0 0 0 1 1 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="193.150.201.37" src_port="6667"/>
        </slice>
        <from usec="0" sec="1246943296"/>
        <to usec="0" sec="1246943342"/>
    </anomaly>
    <anomaly type="suspicious" value="0.753485,0.891565,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="136.90.179.179" dst_port="53"/>
        </slice>
        <from usec="0" sec="1246943296"/>
        <to usec="0" sec="1246943342"/>
    </anomaly>
    <anomaly type="suspicious" value="0.753485,0.891565,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="136.90.68.27" dst_port="53"/>
        </slice>
        <from usec="0" sec="1246943296"/>
        <to usec="0" sec="1246943342"/>
    </anomaly>
    <anomaly type="suspicious" value="0.753485,0.891565,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="141.179.243.8" dst_port="53"/>
        </slice>
        <from usec="0" sec="1246943296"/>
        <to usec="0" sec="1246943342"/>
    </anomaly>
    <anomaly type="suspicious" value="0.753485,0.891565,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="169.185.96.122" dst_port="53"/>
        </slice>
        <from usec="0" sec="1246943296"/>
        <to usec="0" sec="1246943342"/>
    </anomaly>
    <anomaly type="suspicious" value="0.753485,0.891565,999,0 0 0 0 0 0 1 1 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="169.185.97.183" dst_ip="50.196.148.12" dst_port="53"/>
        </slice>
        <from usec="0" sec="1246943296"/>
        <to usec="0" sec="1246943342"/>
    </anomaly>
    <anomaly type="suspicious" value="0.753485,0.891565,999,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter src_ip="88.45.108.109" dst_ip="205.100.251.57"/>
            <filter dst_ip="205.100.251.57" dst_port="3124"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246943342"/>
    </anomaly>
    <anomaly type="suspicious" value="0.991097,1.006520,999,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="205.100.251.57" dst_port="3128"/>
            <filter dst_ip="205.100.251.57" dst_port="3124"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246943342"/>
    </anomaly>
    <anomaly type="suspicious" value="0.753485,0.891565,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="204.204.246.113" src_port="1231" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1246943296"/>
        <to usec="0" sec="1246943342"/>
    </anomaly>
    <anomaly type="suspicious" value="0.753485,0.891565,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="217.228.149.179" src_port="1341" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1246943296"/>
        <to usec="0" sec="1246943342"/>
    </anomaly>
    <anomaly type="suspicious" value="0.753485,0.891565,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="93.42.46.54" src_port="3302" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1246943296"/>
        <to usec="0" sec="1246943342"/>
    </anomaly>
    <anomaly type="suspicious" value="0.753485,0.891565,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="92.35.176.145" src_port="3760" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1246943296"/>
        <to usec="0" sec="1246943342"/>
    </anomaly>
    <anomaly type="suspicious" value="0.979454,0.987796,999,1 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="204.183.249.21" src_port="53"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246943675"/>
    </anomaly>
    <anomaly type="suspicious" value="0.753485,0.891565,002,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="53.136.36.245" src_port="1053" dst_port="137"/>
        </slice>
        <from usec="0" sec="1246943296"/>
        <to usec="0" sec="1246943342"/>
    </anomaly>
    <anomaly type="suspicious" value="0.991097,1.006520,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="204.80.42.67" dst_port="53"/>
        </slice>
        <from usec="0" sec="1246943296"/>
        <to usec="0" sec="1246943387"/>
    </anomaly>
    <anomaly type="suspicious" value="0.991097,1.006520,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="169.185.47.132" src_port="25576"/>
        </slice>
        <from usec="0" sec="1246943341"/>
        <to usec="0" sec="1246943522"/>
    </anomaly>
    <anomaly type="suspicious" value="0.991097,1.006520,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="169.185.47.132" dst_port="25576"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246943387"/>
    </anomaly>
    <anomaly type="suspicious" value="0.991097,1.006520,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmpla">
        <slice>
            <filter src_ip="204.183.249.21" dst_ip="172.16.7.5" src_port="53"/>
            <filter src_ip="204.183.249.21" dst_ip="10.64.169.9" src_port="53"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246942937"/>
    </anomaly>
    <anomaly type="suspicious" value="0.991097,1.006520,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="170.81.81.208" src_port="53"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246942847"/>
    </anomaly>
    <anomaly type="suspicious" value="0.991097,1.006520,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="141.179.243.8" src_port="53"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246942847"/>
    </anomaly>
    <anomaly type="suspicious" value="0.847164,0.951205,503,0 0 0 0 0 0 1 0 1 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="205.100.246.170" dst_ip="104.205.180.110" dst_port="80"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246942937"/>
    </anomaly>
    <anomaly type="suspicious" value="0.991097,1.006520,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="170.81.104.28" dst_port="13580"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246942937"/>
    </anomaly>
    <anomaly type="suspicious" value="0.991097,1.006520,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="205.100.246.69" src_port="53"/>
            <filter dst_ip="205.100.246.69" dst_port="53"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246942847"/>
    </anomaly>
    <anomaly type="suspicious" value="0.991097,1.006520,020,0 0 0 0 0 0 1 1 1 0 0 0,DDoSIC">
        <slice>
            <filter dst_ip="205.100.241.131"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246942937"/>
    </anomaly>
    <anomaly type="suspicious" value="0.991097,1.006520,999,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="193.4.240.102" dst_port="53"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246942937"/>
    </anomaly>
    <anomaly type="suspicious" value="0.991097,1.006520,503,0 0 0 0 0 0 1 1 1 0 0 0,heavy_hitter">
        <slice>
            <filter src_ip="71.40.165.13" dst_ip="205.100.251.49" dst_port="80"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246942847"/>
    </anomaly>
    <anomaly type="suspicious" value="0.991097,1.006520,503,0 0 0 0 0 0 1 1 1 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="138.22.4.84" dst_ip="205.100.251.56" dst_port="80"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246942847"/>
    </anomaly>
    <anomaly type="suspicious" value="0.991097,1.006520,999,0 0 0 0 0 0 1 1 1 0 0 0,mptpla">
        <slice>
            <filter src_ip="205.100.244.36" dst_ip="193.21.130.130" dst_port="53"/>
            <filter src_ip="205.100.253.131" dst_ip="193.21.130.130" dst_port="53"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246942847"/>
    </anomaly>
    <anomaly type="suspicious" value="0.991097,1.006520,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="204.80.31.3" dst_port="53"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246942847"/>
    </anomaly>
    <anomaly type="suspicious" value="0.991097,1.006520,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="141.179.118.154" dst_port="53"/>
        </slice>
        <from usec="0" sec="1246942801"/>
        <to usec="0" sec="1246942847"/>
    </anomaly>
    <anomaly type="suspicious" value="0.991097,1.006520,020,0 0 0 0 0 0 1 1 1 0 0 0,ttl_error">
        <slice>
            <filter src_ip="205.100.245.21"/>
        </slice>
        <from usec="0" sec="1246943296"/>
        <to usec="0" sec="1246943612"/>
    </anomaly>
    <anomaly type="suspicious" value="0.847164,0.951205,999,0 0 0 0 0 0 1 0 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="136.90.179.184" src_port="53"/>
            <filter src_ip="136.90.179.184" dst_port="53"/>
        </slice>
        <from usec="0" sec="1246943296"/>
        <to usec="0" sec="1246943612"/>
    </anomaly>
</admd:annotation>
