<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="anomalous" value="1.985270,1.570120,020,1 1 1 1 1 1 1 1 1 0 0 0,ntscICec">
        <slice>
            <filter src_ip="51.74.18.70"/>
        </slice>
        <from usec="0" sec="1252472401"/>
        <to usec="0" sec="1252473277"/>
    </anomaly>
    <anomaly type="anomalous" value="1.478530,1.328080,020,1 1 1 0 0 0 1 0 0 0 0 0,icmp_error">
        <slice>
            <filter src_ip="206.121.106.140"/>
            <filter dst_ip="51.74.18.70"/>
        </slice>
        <from usec="0" sec="1252472430"/>
        <to usec="0" sec="1252473274"/>
    </anomaly>
    <anomaly type="anomalous" value="1.596370,1.357860,010,1 1 1 0 0 0 1 1 1 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="214.6.250.117" src_port="6000" dst_port="2967"/>
        </slice>
        <from usec="0" sec="1252473211"/>
        <to usec="0" sec="1252473295"/>
    </anomaly>
    <anomaly type="anomalous" value="1.520780,1.378660,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="57.88.176.5" dst_port="25"/>
        </slice>
        <from usec="0" sec="1252472531"/>
        <to usec="0" sec="1252472544"/>
    </anomaly>
    <anomaly type="anomalous" value="1.305590,1.177080,503,0 0 0 1 1 1 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="168.91.197.170" src_port="80"/>
            <filter dst_ip="3.11.81.170" src_port="80"/>
            <filter src_ip="174.164.147.32" dst_ip="3.11.81.170" src_port="8888"/>
        </slice>
        <from usec="0" sec="1252472401"/>
        <to usec="0" sec="1252472779"/>
    </anomaly>
    <anomaly type="anomalous" value="1.305590,1.177080,503,0 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="153.242.250.74" dst_ip="149.51.224.63" src_port="80"/>
        </slice>
        <from usec="0" sec="1252472401"/>
        <to usec="0" sec="1252472852"/>
    </anomaly>
    <anomaly type="anomalous" value="1.305590,1.177080,503,0 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="55.102.129.59" dst_ip="174.164.118.128" src_port="80"/>
        </slice>
        <from usec="0" sec="1252472401"/>
        <to usec="0" sec="1252472555"/>
    </anomaly>
    <anomaly type="anomalous" value="1.074840,1.055660,999,0 0 0 1 1 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="149.51.227.96" src_port="10463"/>
            <filter src_ip="149.51.227.96" src_port="5194"/>
        </slice>
        <from usec="0" sec="1252472401"/>
        <to usec="0" sec="1252473229"/>
    </anomaly>
    <anomaly type="anomalous" value="1.305590,1.177080,503,0 0 0 1 1 1 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="174.164.147.88" dst_ip="3.11.85.231" src_port="80"/>
        </slice>
        <from usec="0" sec="1252472403"/>
        <to usec="0" sec="1252472882"/>
    </anomaly>
    <anomaly type="anomalous" value="1.305590,1.177080,999,0 0 0 1 1 1 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="149.51.227.114" dst_ip="55.181.151.104" src_port="9039" dst_port="9115"/>
        </slice>
        <from usec="0" sec="1252472401"/>
        <to usec="0" sec="1252473049"/>
    </anomaly>
    <anomaly type="anomalous" value="1.305590,1.177080,503,0 0 0 1 1 1 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="206.121.97.163" dst_ip="202.100.244.188" src_port="80"/>
            <filter src_ip="206.121.97.162" dst_ip="202.100.244.188" src_port="80"/>
        </slice>
        <from usec="0" sec="1252472401"/>
        <to usec="0" sec="1252473041"/>
    </anomaly>
    <anomaly type="anomalous" value="1.305590,1.177080,503,0 0 0 1 1 1 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="206.121.101.72" dst_ip="1.125.61.71" dst_port="80"/>
            <filter src_ip="149.51.63.138" dst_ip="1.125.61.71" dst_port="80"/>
            <filter src_ip="149.51.63.134" dst_ip="1.125.61.71" dst_port="80"/>
        </slice>
        <from usec="0" sec="1252472408"/>
        <to usec="0" sec="1252473048"/>
    </anomaly>
    <anomaly type="anomalous" value="1.305590,1.177080,999,0 0 0 1 1 1 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="149.51.227.114" dst_ip="108.6.227.115" src_port="9039" dst_port="14906"/>
        </slice>
        <from usec="0" sec="1252472410"/>
        <to usec="0" sec="1252473049"/>
    </anomaly>
    <anomaly type="anomalous" value="1.305590,1.177080,503,0 0 0 1 1 1 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="206.121.97.162" dst_ip="109.87.242.173" src_port="80"/>
            <filter src_ip="206.121.97.163" dst_ip="109.87.242.173" src_port="80"/>
        </slice>
        <from usec="0" sec="1252472925"/>
        <to usec="0" sec="1252473044"/>
    </anomaly>
    <anomaly type="anomalous" value="1.305590,1.177080,503,0 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="188.9.90.186" dst_ip="3.11.81.46" src_port="80" dst_port="52974"/>
            <filter src_ip="188.9.90.186" dst_ip="3.11.81.46" src_port="80" dst_port="45839"/>
            <filter src_ip="188.9.90.186" dst_ip="3.11.81.46" src_port="80" dst_port="37014"/>
        </slice>
        <from usec="0" sec="1252473002"/>
        <to usec="0" sec="1252473109"/>
    </anomaly>
    <anomaly type="anomalous" value="1.305590,1.177080,503,0 0 0 1 1 1 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="174.164.139.166" dst_ip="49.209.253.124" src_port="80"/>
        </slice>
        <from usec="0" sec="1252473035"/>
        <to usec="0" sec="1252473121"/>
    </anomaly>
    <anomaly type="anomalous" value="1.305590,1.177080,503,0 0 0 1 1 1 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="174.164.234.36" dst_ip="207.94.163.5" src_port="80" dst_port="55713"/>
            <filter src_ip="174.164.234.36" dst_ip="207.94.163.5" src_port="80" dst_port="53948"/>
            <filter src_ip="206.121.109.108" dst_ip="207.94.163.5" src_port="53" dst_port="42222"/>
        </slice>
        <from usec="0" sec="1252473090"/>
        <to usec="0" sec="1252473139"/>
    </anomaly>
    <anomaly type="anomalous" value="1.440370,1.159510,503,1 0 0 1 1 1 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="207.95.101.216" src_port="80"/>
            <filter dst_ip="207.95.101.216" src_port="53"/>
        </slice>
        <from usec="0" sec="1252472401"/>
        <to usec="0" sec="1252473257"/>
    </anomaly>
    <anomaly type="anomalous" value="1.305590,1.177080,503,0 0 0 1 1 1 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="207.83.53.17" src_port="80"/>
        </slice>
        <from usec="0" sec="1252472401"/>
        <to usec="0" sec="1252472959"/>
    </anomaly>
    <anomaly type="anomalous" value="1.006320,0.909485,503,1 0 0 1 0 0 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="206.121.100.138" src_port="80"/>
        </slice>
        <from usec="0" sec="1252472401"/>
        <to usec="0" sec="1252473301"/>
    </anomaly>
    <anomaly type="anomalous" value="0.937125,0.900719,999,0 0 0 1 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="149.51.227.96" dst_port="5194"/>
            <filter dst_ip="149.51.227.96" dst_port="10463"/>
        </slice>
        <from usec="0" sec="1252472401"/>
        <to usec="0" sec="1252473229"/>
    </anomaly>
    <anomaly type="anomalous" value="0.937125,0.900719,999,0 0 0 1 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_ip="149.51.63.133" dst_ip="108.22.94.31"/>
            <filter src_ip="149.51.63.133" src_port="3128"/>
            <filter src_ip="149.51.63.133" src_port="3124"/>
            <filter dst_ip="108.22.94.31" src_port="3128"/>
        </slice>
        <from usec="0" sec="1252472401"/>
        <to usec="0" sec="1252473257"/>
    </anomaly>
    <anomaly type="anomalous" value="1.985270,1.570120,999,1 1 1 1 1 1 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="206.121.100.139"/>
        </slice>
        <from usec="0" sec="1252472401"/>
        <to usec="0" sec="1252473301"/>
    </anomaly>
    <anomaly type="anomalous" value="1.596370,1.357860,999,1 1 1 0 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_ip="193.185.52.25" src_port="53"/>
            <filter dst_ip="193.185.52.25" dst_port="53"/>
        </slice>
        <from usec="0" sec="1252472401"/>
        <to usec="0" sec="1252473257"/>
    </anomaly>
    <anomaly type="anomalous" value="1.150500,1.036110,503,1 1 0 0 0 0 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="149.51.63.138" dst_port="80"/>
            <filter dst_ip="149.51.63.138" dst_port="3128"/>
        </slice>
        <from usec="0" sec="1252472401"/>
        <to usec="0" sec="1252472908"/>
    </anomaly>
    <anomaly type="anomalous" value="1.478530,1.328080,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="200.48.26.43" src_port="12200" dst_port="8080"/>
            <filter src_ip="200.48.26.43" src_port="12200" dst_port="3128"/>
            <filter src_ip="200.48.26.43" src_port="12200" dst_port="80"/>
            <filter src_ip="200.48.26.43" src_port="12200" dst_port="1080"/>
        </slice>
        <from usec="0" sec="1252472626"/>
        <to usec="0" sec="1252472672"/>
    </anomaly>
    <anomaly type="anomalous" value="1.440370,1.159510,999,1 0 0 1 1 1 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="206.121.100.139"/>
        </slice>
        <from usec="0" sec="1252472401"/>
        <to usec="0" sec="1252473301"/>
    </anomaly>
    <anomaly type="anomalous" value="1.586500,1.366750,010,1 1 1 1 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="212.246.40.164" dst_port="3128"/>
            <filter src_ip="212.246.40.164" dst_port="8080"/>
            <filter src_ip="212.246.40.164" dst_port="8000"/>
            <filter src_ip="212.246.40.164" dst_port="80"/>
        </slice>
        <from usec="0" sec="1252472851"/>
        <to usec="0" sec="1252472915"/>
    </anomaly>
    <anomaly type="anomalous" value="1.440370,1.159510,503,1 0 0 1 1 1 1 1 1 0 0 0,ntscACK">
        <slice>
            <filter src_ip="207.95.101.216" dst_port="80"/>
            <filter src_ip="207.95.101.216" dst_port="53"/>
        </slice>
        <from usec="0" sec="1252472401"/>
        <to usec="0" sec="1252473257"/>
    </anomaly>
    <anomaly type="anomalous" value="1.478530,1.328080,999,1 1 1 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="149.51.63.132" dst_port="3124"/>
            <filter dst_ip="149.51.63.132" dst_port="3128"/>
        </slice>
        <from usec="0" sec="1252472401"/>
        <to usec="0" sec="1252473257"/>
    </anomaly>
    <anomaly type="suspicious" value="0.667921,0.883100,503,1 0 0 0 0 0 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="168.76.127.121" dst_ip="216.97.210.225" src_port="80" dst_port="65006" proto="tcp"/>
        </slice>
        <from usec="0" sec="1252473221"/>
        <to usec="0" sec="1252473223"/>
    </anomaly>
    <anomaly type="suspicious" value="0.667921,0.883100,503,1 0 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="149.51.40.82"/>
        </slice>
        <from usec="0" sec="1252472531"/>
        <to usec="0" sec="1252472536"/>
    </anomaly>
    <anomaly type="suspicious" value="0.667921,0.883100,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="149.51.184.162" dst_ip="194.132.71.228" src_port="1567" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1252472541"/>
        <to usec="0" sec="1252472543"/>
    </anomaly>
    <anomaly type="suspicious" value="0.667921,0.883100,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="194.132.71.228"/>
        </slice>
        <from usec="0" sec="1252472539"/>
        <to usec="0" sec="1252472542"/>
    </anomaly>
    <anomaly type="suspicious" value="0.667921,0.883100,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="174.164.224.82" dst_ip="91.117.176.63" src_port="61225" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1252472671"/>
        <to usec="0" sec="1252472680"/>
    </anomaly>
    <anomaly type="suspicious" value="0.667921,0.883100,999,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="150.34.101.227"/>
        </slice>
        <from usec="0" sec="1252472534"/>
        <to usec="0" sec="1252472536"/>
    </anomaly>
    <anomaly type="suspicious" value="0.667921,0.883100,504,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="206.121.118.225" dst_ip="108.114.133.93" dst_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1252472532"/>
        <to usec="0" sec="1252472672"/>
    </anomaly>
    <anomaly type="suspicious" value="1.043090,1.063230,504,1 1 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="174.164.226.28" dst_ip="13.67.198.123" src_port="49487" dst_port="443"/>
            <filter src_ip="174.164.226.28" dst_ip="217.87.252.75" src_port="49468" dst_port="80"/>
        </slice>
        <from usec="0" sec="1252472531"/>
        <to usec="0" sec="1252472701"/>
    </anomaly>
    <anomaly type="suspicious" value="0.667921,0.883100,503,1 0 0 0 0 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="5.71.252.68" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1252472534"/>
        <to usec="0" sec="1252472544"/>
    </anomaly>
    <anomaly type="suspicious" value="0.667921,0.883100,503,1 0 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="174.164.55.49" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1252472531"/>
        <to usec="0" sec="1252472533"/>
    </anomaly>
    <anomaly type="suspicious" value="0.667921,0.883100,020,1 0 0 0 0 0 0 0 0 0 0 0,icmp_error">
        <slice>
            <filter dst_ip="12.175.19.64" src_port="1024"/>
            <filter dst_ip="12.175.19.64" src_port="3072"/>
            <filter dst_ip="12.175.19.64" dst_port="144"/>
            <filter dst_ip="12.175.19.64" dst_port="113"/>
            <filter src_port="1024" dst_port="144"/>
            <filter src_port="1024" dst_port="113"/>
            <filter src_port="3072" dst_port="144"/>
            <filter src_port="3072" dst_port="113"/>
            <filter dst_ip="12.175.19.64"/>
        </slice>
        <from usec="0" sec="1252472430"/>
        <to usec="0" sec="1252473187"/>
    </anomaly>
    <anomaly type="suspicious" value="0.667921,0.883100,999,1 0 0 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="206.121.101.65" proto="tcp"/>
        </slice>
        <from usec="0" sec="1252472645"/>
        <to usec="0" sec="1252472647"/>
    </anomaly>
    <anomaly type="suspicious" value="0.667921,0.883100,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="194.56.107.60" dst_port="445" proto="tcp"/>
        </slice>
        <from usec="0" sec="1252472627"/>
        <to usec="0" sec="1252472718"/>
    </anomaly>
    <anomaly type="suspicious" value="0.667921,0.883100,020,1 0 0 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="51.74.16.1" proto="icmp"/>
        </slice>
        <from usec="0" sec="1252472684"/>
        <to usec="0" sec="1252473131"/>
    </anomaly>
    <anomaly type="suspicious" value="0.667921,0.883100,999,1 0 0 0 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="149.51.225.66"/>
        </slice>
        <from usec="0" sec="1252472534"/>
        <to usec="0" sec="1252472536"/>
    </anomaly>
    <anomaly type="suspicious" value="0.667921,0.883100,020,1 0 0 0 0 0 0 0 0 0 0 0,ntscUDPICdurp">
        <slice>
            <filter dst_ip="49.253.25.246" proto="icmp"/>
        </slice>
        <from usec="0" sec="1252472947"/>
        <to usec="0" sec="1252472950"/>
    </anomaly>
    <anomaly type="suspicious" value="1.043090,1.063230,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="54.94.200.110"/>
        </slice>
        <from usec="0" sec="1252472681"/>
        <to usec="0" sec="1252473285"/>
    </anomaly>
    <anomaly type="suspicious" value="0.667921,0.883100,504,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="174.164.226.28" dst_ip="13.67.198.123" src_port="49487" dst_port="443"/>
        </slice>
        <from usec="0" sec="1252472686"/>
        <to usec="0" sec="1252472712"/>
    </anomaly>
    <anomaly type="suspicious" value="1.043090,1.063230,503,1 1 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="207.83.50.81" dst_ip="54.241.138.254" src_port="41810" dst_port="80"/>
            <filter src_ip="207.83.50.81" dst_ip="217.42.54.18" src_port="41822" dst_port="80"/>
        </slice>
        <from usec="0" sec="1252472531"/>
        <to usec="0" sec="1252472543"/>
    </anomaly>
    <anomaly type="suspicious" value="1.043090,1.063230,504,1 1 0 0 0 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="174.164.224.42" dst_port="443"/>
            <filter dst_ip="153.30.138.189" dst_port="443"/>
        </slice>
        <from usec="0" sec="1252472666"/>
        <to usec="0" sec="1252472689"/>
    </anomaly>
    <anomaly type="suspicious" value="1.043090,1.063230,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscICecrqICecrqdurmterp">
        <slice>
            <filter dst_ip="51.74.16.1"/>
        </slice>
        <from usec="0" sec="1252472829"/>
        <to usec="0" sec="1252472830"/>
    </anomaly>
    <anomaly type="suspicious" value="0.881511,0.940264,999,1 0 0 1 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="174.164.69.29" dst_ip="14.128.24.113" dst_port="50004"/>
        </slice>
        <from usec="0" sec="1252472401"/>
        <to usec="0" sec="1252473213"/>
    </anomaly>
    <anomaly type="suspicious" value="0.881511,0.940264,999,1 0 0 1 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="174.164.225.128" src_port="9186"/>
        </slice>
        <from usec="0" sec="1252472401"/>
        <to usec="0" sec="1252472959"/>
    </anomaly>
    <anomaly type="suspicious" value="0.801620,0.931788,503,0 0 0 1 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="61.236.104.131"/>
        </slice>
        <from usec="0" sec="1252472940"/>
        <to usec="0" sec="1252472959"/>
    </anomaly>
    <anomaly type="suspicious" value="0.825668,0.850253,999,1 0 0 0 0 0 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="206.121.101.72" dst_port="3124"/>
            <filter dst_ip="206.121.101.72" dst_port="3128"/>
            <filter dst_ip="206.121.101.72" dst_port="80"/>
        </slice>
        <from usec="0" sec="1252472401"/>
        <to usec="0" sec="1252473238"/>
    </anomaly>
    <anomaly type="suspicious" value="0.825668,0.850253,999,1 0 0 0 0 0 1 1 1 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="207.137.59.76" dst_ip="154.233.202.227" src_port="53"/>
        </slice>
        <from usec="0" sec="1252472401"/>
        <to usec="0" sec="1252473257"/>
    </anomaly>
    <anomaly type="suspicious" value="0.825668,0.850253,999,1 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="206.121.101.65" dst_port="3124"/>
            <filter dst_ip="206.121.101.65" dst_port="3128"/>
        </slice>
        <from usec="0" sec="1252472401"/>
        <to usec="0" sec="1252473107"/>
    </anomaly>
    <anomaly type="suspicious" value="0.825668,0.850253,999,1 0 0 0 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter dst_ip="193.34.226.42" dst_port="53"/>
            <filter src_ip="206.121.108.185" src_port="51440" dst_port="53"/>
        </slice>
        <from usec="0" sec="1252472401"/>
        <to usec="0" sec="1252472944"/>
    </anomaly>
    <anomaly type="suspicious" value="0.806428,0.864394,503,1 0 0 1 0 0 1 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="206.121.100.138" dst_port="80"/>
        </slice>
        <from usec="0" sec="1252472401"/>
        <to usec="0" sec="1252473301"/>
    </anomaly>
    <anomaly type="suspicious" value="0.739770,0.840870,053,0 0 0 0 0 0 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="206.121.101.73" dst_port="3128"/>
            <filter src_ip="172.248.243.136" dst_ip="206.121.101.73" dst_port="80"/>
        </slice>
        <from usec="0" sec="1252472401"/>
        <to usec="0" sec="1252472717"/>
    </anomaly>
    <anomaly type="suspicious" value="0.739770,0.840870,999,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="206.121.101.64" dst_port="3128"/>
            <filter dst_ip="206.121.101.64"/>
        </slice>
        <from usec="0" sec="1252472401"/>
        <to usec="0" sec="1252472717"/>
    </anomaly>
    <anomaly type="suspicious" value="0.739770,0.840870,999,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="149.51.63.134" dst_port="56054"/>
        </slice>
        <from usec="0" sec="1252472401"/>
        <to usec="0" sec="1252472717"/>
    </anomaly>
    <anomaly type="suspicious" value="0.565139,0.801839,503,1 0 0 0 0 0 1 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="207.95.100.43" dst_port="80"/>
        </slice>
        <from usec="0" sec="1252472893"/>
        <to usec="0" sec="1252473122"/>
    </anomaly>
    <anomaly type="suspicious" value="0.980456,0.996769,020,1 1 0 0 0 0 1 0 0 0 0 0,ttl_error">
        <slice>
            <filter src_ip="206.121.106.216"/>
        </slice>
        <from usec="0" sec="1252472433"/>
        <to usec="0" sec="1252473285"/>
    </anomaly>
    <anomaly type="suspicious" value="0.739770,0.840870,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="206.121.106.199" dst_port="16881"/>
            <filter dst_ip="206.121.106.199"/>
        </slice>
        <from usec="0" sec="1252472401"/>
        <to usec="0" sec="1252472447"/>
    </anomaly>
    <anomaly type="suspicious" value="0.595839,0.813260,010,0 0 0 0 0 0 1 1 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="12.175.19.64" src_port="144" dst_port="1024"/>
            <filter src_ip="12.175.19.64" src_port="135" dst_port="1024"/>
            <filter src_ip="12.175.19.64" src_port="113" dst_port="1024"/>
        </slice>
        <from usec="0" sec="1252472851"/>
        <to usec="0" sec="1252473257"/>
    </anomaly>
    <anomaly type="suspicious" value="0.595839,0.813260,010,0 0 0 0 0 0 1 1 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="12.175.19.64" src_port="144" dst_port="3072"/>
            <filter src_ip="12.175.19.64" src_port="113" dst_port="3072"/>
            <filter src_ip="12.175.19.64" src_port="135" dst_port="3072"/>
        </slice>
        <from usec="0" sec="1252472851"/>
        <to usec="0" sec="1252473257"/>
    </anomaly>
    <anomaly type="suspicious" value="0.739770,0.840870,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="206.121.106.210" dst_port="16881"/>
        </slice>
        <from usec="0" sec="1252472401"/>
        <to usec="0" sec="1252472447"/>
    </anomaly>
    <anomaly type="suspicious" value="0.739770,0.840870,020,0 0 0 0 0 0 1 1 1 0 0 0,icmp_error">
        <slice>
            <filter dst_ip="207.95.114.137"/>
        </slice>
        <from usec="0" sec="1252472401"/>
        <to usec="0" sec="1252472447"/>
    </anomaly>
    <anomaly type="suspicious" value="0.739770,0.840870,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="168.76.71.107" dst_port="49763"/>
        </slice>
        <from usec="0" sec="1252472401"/>
        <to usec="0" sec="1252472447"/>
    </anomaly>
    <anomaly type="suspicious" value="0.739770,0.840870,503,0 0 0 0 0 0 1 1 1 0 0 0,salphfl">
        <slice>
            <filter src_ip="218.228.124.60" dst_ip="168.92.84.211" src_port="80"/>
        </slice>
        <from usec="0" sec="1252472401"/>
        <to usec="0" sec="1252472447"/>
    </anomaly>
    <anomaly type="suspicious" value="0.739770,0.840870,999,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="206.121.106.148" dst_port="10785"/>
        </slice>
        <from usec="0" sec="1252472401"/>
        <to usec="0" sec="1252472447"/>
    </anomaly>
    <anomaly type="suspicious" value="0.739770,0.840870,503,0 0 0 0 0 0 1 1 1 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="218.124.183.210" dst_ip="174.164.139.23" src_port="80"/>
        </slice>
        <from usec="0" sec="1252472401"/>
        <to usec="0" sec="1252472447"/>
    </anomaly>
    <anomaly type="suspicious" value="0.739770,0.840870,999,0 0 0 0 0 0 1 1 1 0 0 0,alphfl">
        <slice>
            <filter src_ip="214.8.37.45" dst_ip="168.76.127.20" dst_port="25"/>
        </slice>
        <from usec="0" sec="1252472401"/>
        <to usec="0" sec="1252472447"/>
    </anomaly>
    <anomaly type="suspicious" value="0.739770,0.840870,020,0 0 0 0 0 0 1 1 1 0 0 0,ntscICecrqICecrqdurmterp">
        <slice>
            <filter dst_ip="218.216.97.245"/>
        </slice>
        <from usec="0" sec="1252472401"/>
        <to usec="0" sec="1252472447"/>
    </anomaly>
    <anomaly type="suspicious" value="0.739770,0.840870,999,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="206.121.106.47" dst_port="39733"/>
        </slice>
        <from usec="0" sec="1252472401"/>
        <to usec="0" sec="1252472717"/>
    </anomaly>
    <anomaly type="suspicious" value="0.739770,0.840870,020,0 0 0 0 0 0 1 1 1 0 0 0,DDoSIC">
        <slice>
            <filter dst_ip="206.121.108.71"/>
        </slice>
        <from usec="0" sec="1252472401"/>
        <to usec="0" sec="1252472447"/>
    </anomaly>
    <anomaly type="suspicious" value="0.739770,0.840870,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="193.13.108.148" dst_port="53"/>
        </slice>
        <from usec="0" sec="1252472401"/>
        <to usec="0" sec="1252472447"/>
    </anomaly>
    <anomaly type="suspicious" value="0.739770,0.840870,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="144.40.158.33" src_port="53"/>
        </slice>
        <from usec="0" sec="1252472401"/>
        <to usec="0" sec="1252472447"/>
    </anomaly>
    <anomaly type="suspicious" value="0.739770,0.840870,999,0 0 0 0 0 0 1 1 1 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="168.76.127.16" dst_ip="1.4.122.44" src_port="53"/>
        </slice>
        <from usec="0" sec="1252472401"/>
        <to usec="0" sec="1252472447"/>
    </anomaly>
    <anomaly type="suspicious" value="0.739770,0.840870,503,0 0 0 0 0 0 1 1 1 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="56.206.82.10" dst_ip="149.51.63.132" dst_port="80"/>
        </slice>
        <from usec="0" sec="1252472401"/>
        <to usec="0" sec="1252472447"/>
    </anomaly>
    <anomaly type="suspicious" value="0.739770,0.840870,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="144.40.159.7" src_port="53"/>
        </slice>
        <from usec="0" sec="1252472401"/>
        <to usec="0" sec="1252472447"/>
    </anomaly>
    <anomaly type="suspicious" value="0.739770,0.840870,503,0 0 0 0 0 0 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="206.121.97.163" dst_port="80"/>
        </slice>
        <from usec="0" sec="1252472401"/>
        <to usec="0" sec="1252472447"/>
    </anomaly>
    <anomaly type="suspicious" value="0.739770,0.840870,503,0 0 0 0 0 0 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="206.121.97.162" dst_port="80"/>
        </slice>
        <from usec="0" sec="1252472401"/>
        <to usec="0" sec="1252472447"/>
    </anomaly>
    <anomaly type="suspicious" value="0.595839,0.813260,010,0 0 0 0 0 0 1 1 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="149.51.63.132" dst_ip="9.9.155.53" src_port="3124"/>
        </slice>
        <from usec="0" sec="1252472896"/>
        <to usec="0" sec="1252472942"/>
    </anomaly>
    <anomaly type="suspicious" value="0.739770,0.840870,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="174.164.83.42" src_port="53"/>
            <filter dst_ip="174.164.83.42" dst_port="53"/>
        </slice>
        <from usec="0" sec="1252472401"/>
        <to usec="0" sec="1252472447"/>
    </anomaly>
    <anomaly type="suspicious" value="0.825668,0.850253,999,1 0 0 0 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_ip="206.121.101.72"/>
            <filter dst_ip="149.51.63.133"/>
        </slice>
        <from usec="0" sec="1252472401"/>
        <to usec="0" sec="1252473257"/>
    </anomaly>
    <anomaly type="suspicious" value="0.739770,0.840870,999,0 0 0 0 0 0 1 1 1 0 0 0,salphfl">
        <slice>
            <filter src_ip="207.95.118.239" dst_ip="193.9.138.218" dst_port="53"/>
        </slice>
        <from usec="0" sec="1252472401"/>
        <to usec="0" sec="1252472447"/>
    </anomaly>
    <anomaly type="suspicious" value="0.739770,0.840870,999,0 0 0 0 0 0 1 1 1 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="193.185.52.25" dst_ip="110.178.232.205" src_port="53"/>
        </slice>
        <from usec="0" sec="1252472401"/>
        <to usec="0" sec="1252472447"/>
    </anomaly>
    <anomaly type="suspicious" value="0.739770,0.840870,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="168.76.127.70" src_port="53"/>
        </slice>
        <from usec="0" sec="1252472401"/>
        <to usec="0" sec="1252472447"/>
    </anomaly>
    <anomaly type="suspicious" value="0.739770,0.840870,999,0 0 0 0 0 0 1 1 1 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="193.52.249.105" dst_ip="206.152.221.68" src_port="53"/>
        </slice>
        <from usec="0" sec="1252472401"/>
        <to usec="0" sec="1252472447"/>
    </anomaly>
    <anomaly type="suspicious" value="0.739770,0.840870,999,0 0 0 0 0 0 1 1 1 0 0 0,mptpla">
        <slice>
            <filter dst_ip="111.64.17.231" dst_port="53"/>
        </slice>
        <from usec="0" sec="1252472401"/>
        <to usec="0" sec="1252472447"/>
    </anomaly>
    <anomaly type="suspicious" value="0.739770,0.840870,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="168.76.127.16" dst_port="53"/>
        </slice>
        <from usec="0" sec="1252472401"/>
        <to usec="0" sec="1252472447"/>
    </anomaly>
</admd:annotation>
